MALICIOUS — 987e2718fef1adc28fde2dd6525f97ea5c25eda5e456fcfed151af73b3b2408e

MALICIOUS — 987e2718fef1adc28fde2dd6525f97ea5c25eda5e456fcfed151af73b3b2408e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 987e2718fef1adc28fde2dd6525f97ea5c25eda5e456fcfed151af73b3b2408e
SHA-1: 9acb37f54a647d7e78b3eede24bd1b3ff54e641e
MD5: 0bd9ab5a87cbbf332a1607c32bbe306f
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dts4efUZYj62WgnsmRIWHDgv:Qoa1taC0Gs4tZYG2/siIWjgv
TLSH: T1705A23866519670CE2F6C5803929257EC441E4E7A338298FA38FF01FB3DB967781119B
Submitted as: 987e2718fef1adc28fde2dd6525f97ea5c25eda5e456fcfed151af73b3b2408e
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

87 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3932.tmp - 549eb3b8e99eda85662c65fa4eeab028064c7d2894889e857f99923e25f3eaac
4fd47806ddf64b6f1e7f3a7ed656d5a3fffd6fca0d6b8c8f80dbd40ebe8e636a - 4fd47806ddf64b6f1e7f3a7ed656d5a3fffd6fca0d6b8c8f80dbd40ebe8e636a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787825512&P2=404&P3=2&P4=W2WdgCxRy3E15Wb6r6nXqRDP2dGwSqykWAMuy%2f4U5OHL3%2bneB3v0Uoc%2bOaW3gC14dhY0edkn%2fMuv6F9%2bKblutQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787825534&P2=404&P3=2&P4=YysARULzRXIVLPOOk3THg%2bmfLFSa0PVXnfy0IG%2fjhMO1BYvH4Ltx1x6tBihUBYgJZLMAyK8gh8Bmd%2f%2bWbFQquQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

1r.es
schemas.microsoft.com

Embedded IP addresses

52.168.117.168
4.230.171.124
20.247.184.197
57.155.101.212
20.165.94.63
4.150.223.103
74.178.76.54
4.207.44.76
20.112.250.133
52.123.128.14
52.123.129.14
92.223.78.30
172.178.240.163
52.123.252.244
52.123.252.215
4.150.223.109
4.150.223.111
203.26.79.13
20.165.94.46
52.148.114.188
4.247.188.233
72.153.5.136
48.199.12.1
52.110.12.26
135.233.45.221

File paths

Q:\b

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report