MALICIOUS — a91a769335c53bfb50482b7f7895b256e52c3311f8d99a8b60b4f4ddba563e63

MALICIOUS — a91a769335c53bfb50482b7f7895b256e52c3311f8d99a8b60b4f4ddba563e63 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a91a769335c53bfb50482b7f7895b256e52c3311f8d99a8b60b4f4ddba563e63
SHA-1: ebdb53c6e806205b67f52f986d4d5d400629e174
MD5: 3122448079066737a4917e753546c1f1
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dcXhXi8TgnBeMv1eUXiRFshdWRDVuqv+Y2jTg:Qoa1taC070dcRCeMv1NXiRQcRrsg
TLSH: T13F5A238A5619270CE3F6C4843D2E226DC442E4F79379198E428FF04FA7C79A7786119B
Submitted as: a91a769335c53bfb50482b7f7895b256e52c3311f8d99a8b60b4f4ddba563e63
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\93AF.tmp - 9fc90dd4b5b7faa92fe949a722e3d27c984ce2632455c3cc21595c6cfd36bff1
aa6edf35fb015b2ee229a1a461975684a0d05889e731f884fe4662a585692aa9 - aa6edf35fb015b2ee229a1a461975684a0d05889e731f884fe4662a585692aa9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787926855&P2=404&P3=2&P4=l8A2SFPbQHbtnaYwfK8EHqx6cS3ShAJvqSPzpg57H716tufAhclVjhGf50GwczP94gUU5lgc8l9WCGn%2bIT3oFA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787926921&P2=404&P3=2&P4=SCnbfajBQUhAmFqAaQABfjHLaKJQ3aXNaRXfdQpM39pY3273r2kNPcJwHRonaNO3NSXBVpaHC3Y927qm8Ixz1g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

40.84.97.4
4.150.223.102
52.123.252.243
52.123.252.223
4.230.171.124
172.215.188.232
4.144.132.223
52.123.252.230
74.178.76.44
135.232.92.137
52.168.117.168
74.178.76.54
52.123.252.194
203.26.79.13
20.112.250.133
52.123.128.14
52.123.129.14
135.233.45.221
52.110.12.24
52.148.114.188
52.110.12.3
72.153.5.130
135.232.92.34

File paths

B:\F

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report