MALICIOUS — 951a4702b1cfb8e5d9aada25045ce5564c3e5ecc537b008c57aada52ac458cd0

MALICIOUS — 951a4702b1cfb8e5d9aada25045ce5564c3e5ecc537b008c57aada52ac458cd0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 951a4702b1cfb8e5d9aada25045ce5564c3e5ecc537b008c57aada52ac458cd0
SHA-1: ba74b7d802aa940a56d94840e9c71c3b34ab01f0
MD5: 7732ab5e379fd50693c4faec718cbb20
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dyj6hA1EGTM+/IILjwHkwf:Qoa1taC0bjD2GxLjwHkm
TLSH: T15A5A23894609670CE7FAC4C4A969265EC842D8E3A774158F92CFF08FB3CB5277812197
Submitted as: 951a4702b1cfb8e5d9aada25045ce5564c3e5ecc537b008c57aada52ac458cd0
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\46B8.tmp - 196ca4df4cdffea9ba38f7d87e971f3d2fb80ea589ff060d4a75750633c57594
8c4073220f236dab518bd3bc8e8dcdbeb04cc21f87bd6c00ae717b04918acf87 - 8c4073220f236dab518bd3bc8e8dcdbeb04cc21f87bd6c00ae717b04918acf87

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787811365&P2=404&P3=2&P4=h9ywdMWXwG0n66Y%2fZt8Y%2f6ZdX6QU7TNezOYR2mCfwVBnRu5GWq8s3xwXtiW3Q2huQeea4LNfPDdQPKwGGK9tzw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787811402&P2=404&P3=2&P4=jw1GIUv8l%2fHB8yXV6PgT65y%2bQ3vuSdTLj7LujMAtUbOMEcqf%2fAg6xvXRzYEZwOBS5vRMm7gZBNuTJl1bUXqivg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.207.44.75
52.123.252.218
40.84.85.40
4.230.171.124
52.253.84.76
74.178.240.61
135.233.95.135
20.42.73.24
52.123.128.14
20.231.239.246
52.123.129.14
20.184.175.14
172.178.240.163
203.26.79.13
74.178.76.44
92.223.78.30
57.154.63.210
52.148.114.188
52.110.12.15
52.110.12.52
125.56.205.51
125.56.205.8
52.123.252.215
72.153.5.135
74.179.71.159

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report