MALICIOUS — ab2e57d238508fcd7bd0e85d97671b4c20473b2b7bcecc8eb3b5ca24d8505105

MALICIOUS — ab2e57d238508fcd7bd0e85d97671b4c20473b2b7bcecc8eb3b5ca24d8505105 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: ab2e57d238508fcd7bd0e85d97671b4c20473b2b7bcecc8eb3b5ca24d8505105
SHA-1: 3131e9069e72125f4c277c02acfbf4a7291e9afc
MD5: 628942585fae7e895ec72ccc098b401c
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dpdG8EqBxQX4GJFBajGsj1m+fai:Qoa1taC0UFxO4sfab1ai
TLSH: T1655A228A5609374CE2F2C4842D182A6EC842E4F66338198FD18FF05FB7DB657742259B
Submitted as: ab2e57d238508fcd7bd0e85d97671b4c20473b2b7bcecc8eb3b5ca24d8505105
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\7332.tmp - e8bace4f65c266fca84f0f85dde845d5ca2330db54222ba7a4373dbe882e60b8
906ac5ea3dd41fc21e8aa73d1068b0bd2f6c3302f9cb1313e6e983ff353477c2 - 906ac5ea3dd41fc21e8aa73d1068b0bd2f6c3302f9cb1313e6e983ff353477c2

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787805337&P2=404&P3=2&P4=d3UVCCuq9Le72T%2bwUi9IQQPz%2bkEhz8tuZTffcXs28fbnZaUy16IqqKQbUnFYtzuvdWRT27621dbWETKoSjOkPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787805357&P2=404&P3=2&P4=f34%2bVaUucLSpO6hd5KfTJRBUd8OpEcXSwjMHLoJ%2bHW5j%2bowFd%2bzT%2b2WtryNYN8yAGHycGFz2IkaSJLUn3cZ2Sw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

yo5.eu
schemas.microsoft.com

Embedded IP addresses

52.123.252.224
4.150.223.103
52.123.252.235
57.155.104.224
4.230.171.124
20.247.184.197
4.247.188.224
52.123.252.220
20.165.94.46
135.233.95.144
74.178.240.51
20.42.73.24
203.26.79.13
20.112.250.133
52.123.128.14
52.123.129.14
52.123.252.195
135.234.160.246
52.148.114.188
20.42.179.204
104.46.162.231
125.56.205.17
72.154.7.101
4.150.223.112
172.175.111.170

File paths

l:\tcz

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report