MALICIOUS — b2a3a130ae61bda45372eb28824bad04b97e28a9b5db1f0a7ac502783363f1a9

MALICIOUS — b2a3a130ae61bda45372eb28824bad04b97e28a9b5db1f0a7ac502783363f1a9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b2a3a130ae61bda45372eb28824bad04b97e28a9b5db1f0a7ac502783363f1a9
SHA-1: 330169e6ea1fc6ae05b5f35f3964ca260e50b4cd
MD5: 71ba376bf99b6a68bc622dbf56daa0ea
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dXLmZ4ID/E6i6bi8LFYZ0r9D:Qoa1taC0se4C/RbxL+69D
TLSH: T1505A235A5609670DE7F6D4803C28216EC841E8E75338298F428FF15DB7DBA6734222DB
Submitted as: b2a3a130ae61bda45372eb28824bad04b97e28a9b5db1f0a7ac502783363f1a9
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\119E.tmp - a8e835c13aee1f001a9964c251f21f236d8b17c4a3fc5b71dfd19284b8d9df73
6e02c2142d3e6878b138b6270b5f8fe3787d0877ecd02f4d019187ea9e674b85 - 6e02c2142d3e6878b138b6270b5f8fe3787d0877ecd02f4d019187ea9e674b85

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787933150&P2=404&P3=2&P4=QWUcqKoScVRGoV%2br7Vem3%2fCrj2D4NibiAUfnQT1VWDm%2fyhY4q8cId%2b%2f%2f%2bAJ8A11Dr%2fc5FvU99RPm%2bkWd2EWT3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787933195&P2=404&P3=2&P4=hnFktwzKG2SYxqsxUe%2f%2fLdtBVmhodU9wk7LHLkMe%2bgqz%2fsW4et2dXSwr7tudkMuLM5NjO3mtuRBLu4dhP8e5Cw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.108
52.253.84.76
4.230.171.124
172.215.188.232
74.178.232.29
74.178.76.128
135.232.92.97
20.50.73.5
74.178.240.61
203.26.79.13
20.236.44.162
52.123.129.14
20.184.175.17
135.233.45.222
52.110.12.25
52.148.114.188
52.110.12.22
72.145.35.102
74.178.76.44
52.110.12.2
52.110.12.44

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report