MALICIOUS — 6ea45df5a985c20b36aea6ed7734271538a7d98ca8a1b6c8b0fcc210a7233336

MALICIOUS — 6ea45df5a985c20b36aea6ed7734271538a7d98ca8a1b6c8b0fcc210a7233336 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6ea45df5a985c20b36aea6ed7734271538a7d98ca8a1b6c8b0fcc210a7233336
SHA-1: 9ccb0ff83d3d28e4121026d55f3e7be9f6fcf8aa
MD5: 3f5b1879b0f03743cbaa85b4ab7a8c1e
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dq+eCkcy0F6seB97zoaONSIxs2PG:Qoa1taC0ekc+ZB97MaipxsCG
TLSH: T1CE5A2385460A670DE2F2C580392D266EC842E4E7677825CF428BF05FB7D796738212DB
Submitted as: 6ea45df5a985c20b36aea6ed7734271538a7d98ca8a1b6c8b0fcc210a7233336
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\C6B1.tmp - b84a31da972ef331e0b5801b910072426f34fc3da30154fcd1d285fe6e421438
4bc8d36ec31542ca55aac6c3a085ae5d37ffe3f5642969fc4ef9d606ace619d2 - 4bc8d36ec31542ca55aac6c3a085ae5d37ffe3f5642969fc4ef9d606ace619d2

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787921189&P2=404&P3=2&P4=B6v0yZIZQSERn872oTSqyxi4GzHaDxlSdknl%2f6e7jaPXvqBGDxLFNH98kZF60JUJRhwb6kiEgoeGi%2fN8Z8cM4Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787921214&P2=404&P3=2&P4=WBotozF4cTPzzYXmfZ4Mf%2boWZXRf27oST1%2bcFsNbx3XlTFueuOClU23o9UbTQHd%2fIc3Ary9kjxxDInMxGy9%2bxg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.73.25
20.42.179.204
4.230.171.124
52.230.60.54
20.165.94.63
74.178.240.51
20.184.175.21
20.76.201.171
52.123.128.14
52.123.129.14
135.234.160.246
172.66.2.5
92.223.78.30
203.26.79.13
74.179.71.159
52.148.114.188
20.42.179.192
13.89.179.15
52.168.117.174
72.145.35.103
4.209.250.170
104.208.16.94
52.110.12.31
52.110.12.24

File paths

g:\,/

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report