MALICIOUS — 7cdfe351c9e759fe5265c17a209e7e796f00babf09176c34ced3a3a125d63403

MALICIOUS — 7cdfe351c9e759fe5265c17a209e7e796f00babf09176c34ced3a3a125d63403 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7cdfe351c9e759fe5265c17a209e7e796f00babf09176c34ced3a3a125d63403
SHA-1: 28c2aa0c0e821e6279c13e61fd7ef0723a48e334
MD5: 87e915cbcbd68ab1f7f17a75c772645a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070drdgUHOoyJFpRD4DEvkkNHYjMBixjkHs:Qoa1taC0EzOoyvD4DEvkkBWMsxYM
TLSH: T1D65A239696145B0CE7F5C4882D68226EC441E4F36378258BC28FF09EB3DB85B78215DB
Submitted as: 7cdfe351c9e759fe5265c17a209e7e796f00babf09176c34ced3a3a125d63403
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3CB6.tmp - 45d661b5a700cde5cacc1ad8b5a9e6af9a404c35d7df71d5ca0141af5b409af7
4c5f0f3dafa54768084999cac9298792ea5ca69cb7651d7d4c48a765c9896c18 - 4c5f0f3dafa54768084999cac9298792ea5ca69cb7651d7d4c48a765c9896c18

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787869595&P2=404&P3=2&P4=KUlDS5umAIdnyFtX6f8x1MUw6tkJfVk0mTqADsfVrUAcQLL4GqXxOFxlLk9NJbkVZRB4FudXffhuNmD%2fP9gAzA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787869619&P2=404&P3=2&P4=N1l6UB15l%2bvniuDcmszIkkNW3I1NJMsu9pxbRVy6shZL1eNYUoerc8Hx6AF1gtNnIDsbNkT%2fkawlloUNjwuPsA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

m.me
schemas.microsoft.com

Embedded IP addresses

52.123.252.219
52.138.229.67
4.230.171.124
57.154.63.210
52.230.59.222
135.232.92.137
20.42.65.88
135.232.92.97
74.178.240.61
92.223.78.30
52.123.128.14
20.112.250.133
40.99.133.210
20.184.175.7
135.234.160.246
4.247.188.233
172.66.2.5
162.159.142.9
52.123.252.230
135.232.92.34
203.26.79.13
52.110.12.52
52.110.12.54
52.148.114.188
72.154.7.112

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report