MALICIOUS — be0c4e2aae6884a31a9378eaef716c36b920c95615e19d1d091186d74534692a

MALICIOUS — be0c4e2aae6884a31a9378eaef716c36b920c95615e19d1d091186d74534692a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: be0c4e2aae6884a31a9378eaef716c36b920c95615e19d1d091186d74534692a
SHA-1: 21087efb335558378da003d02b94909b45edd985
MD5: 87ff88fabe8ffdd72087b3cf02c2a3bf
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFv1IeWCVJZsMqBUHA9vhyGc:O+K88uPCHPrWCV7sdBPHyGc
TLSH: T1E35A2386992D9749E3F2D4902815336EC146F8D6977C49CA028FF11E33CB56B74322AB
Submitted as: be0c4e2aae6884a31a9378eaef716c36b920c95615e19d1d091186d74534692a
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100)

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\35C0.tmp - e6e7a9ff12ff1b3b567bf7de7c2cf473d4b3f44adf48b13f14cebfe780fd76ab
1b5b891e5cb27ba98f73bc1fa4e9fcb92893b51e2a9100c91f9631920231edc9 - 1b5b891e5cb27ba98f73bc1fa4e9fcb92893b51e2a9100c91f9631920231edc9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787917586&P2=404&P3=2&P4=EHPHfztsA6PtEir25JLBSbPlaMCQhtvA%2fsPhJba8XjbspKIcuhuxh16VZGl1ahMvLUJ%2bsyWaVXIRwNqovB9BLw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787917608&P2=404&P3=2&P4=COJ%2b8o4IH9ZAGg%2bUs1PanTo1UvGtQDITJts2Tz73v9jjJlYtyi2hZOQ1ji3WR2e9l0s4gHPHwGKE4vF3GEO6%2fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

52.uk
schemas.microsoft.com

Embedded IP addresses

52.168.117.175
4.144.132.114
4.230.171.124
85.210.196.11
74.179.77.204
4.150.223.110
74.178.240.51
74.178.76.128
92.223.78.30
20.112.250.133
52.123.128.14
52.123.129.14
135.233.45.223
74.178.232.29
203.26.79.13
52.110.12.46
52.148.114.188
52.110.12.10
4.150.223.113
51.132.193.105
72.154.7.104
52.110.12.32
52.110.12.49

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report