MALICIOUS — 79625ee8099afbc823a5e35e98b5eae13421fcd192699b32938969a8f1ba5357

MALICIOUS — 79625ee8099afbc823a5e35e98b5eae13421fcd192699b32938969a8f1ba5357 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 79625ee8099afbc823a5e35e98b5eae13421fcd192699b32938969a8f1ba5357
SHA-1: bf29546f239e024015788549693fbfb51d341f36
MD5: ec47ba0fbc6819122e67e6fff0d6c992
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dYZDgGwuGJCjkKtJ4q9dg5riMeMsQe0:Qoa1taC0pZDQuGEZfg4Mre0
TLSH: T13F5A23895619670CE7F6C5C01D29121EC042E4FB637829CE428FF05EBBC7A6378215AB
Submitted as: 79625ee8099afbc823a5e35e98b5eae13421fcd192699b32938969a8f1ba5357
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

135 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\AD71.tmp - a1f10af8cba5d429883a8b4a70779c96b5f9d3b341ae5aaa5948594b54800af8
35120ab12d2912159b742420cf9e2da1801e5c0f3e2d6c9497326c75c192230c - 35120ab12d2912159b742420cf9e2da1801e5c0f3e2d6c9497326c75c192230c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787859999&P2=404&P3=2&P4=VRKUydqzVBRb%2bFVNMBddrsPtao9l6QWfCgbKIfHoN3RUyufvmN10HflKlShpqhHEaYlJIilOFsLUGFKIdPC2DQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787860032&P2=404&P3=2&P4=BcjeWmo8ut47I7RUZStDwYBLe8f%2bVPug6oEuUMa8w%2beEqXnKiXmg8pSQAS1Rpq6YphAC%2bklXHheqo8rfE%2f2p4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.104
20.42.179.192
4.230.171.124
52.230.60.54
135.233.95.144
135.232.92.97
4.150.223.100
52.123.128.14
20.76.201.171
40.99.133.242
52.123.129.14
135.234.160.244
162.159.142.9
74.178.232.29
52.110.12.37
52.110.12.48
203.26.79.13
52.148.114.188
85.210.193.152
57.155.101.212
52.110.12.44
72.154.7.100
52.110.12.8

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report