MALICIOUS — e0f0d042c32fe78545ef187bd8e853430e629912f3522a84cf6288cfea0b7bb1

MALICIOUS — e0f0d042c32fe78545ef187bd8e853430e629912f3522a84cf6288cfea0b7bb1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e0f0d042c32fe78545ef187bd8e853430e629912f3522a84cf6288cfea0b7bb1
SHA-1: 025452a6a19b4c62d10edbd988b62613ed0fbd51
MD5: 7dcebf15f130c5837fa194cdeee9b58e
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070deziB78TmTOLlvEPd/rSgDqIPh:Qoa1taC09+BImS5UNrSgWIPh
TLSH: T1D45A234696197B0DE3F6C4802C2D126D8482E4EBA33C19CA52CFF01E77DB9A77821597
Submitted as: e0f0d042c32fe78545ef187bd8e853430e629912f3522a84cf6288cfea0b7bb1
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\1920.tmp - 6e95573433e963e112e17e53e28692c0f73e0cb37436121ee43b977a1d36130d
feb1b09392917197b02d70ce3edee2aa6b63906dde6d6f69ba0d59b69551e095 - feb1b09392917197b02d70ce3edee2aa6b63906dde6d6f69ba0d59b69551e095

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787941304&P2=404&P3=2&P4=iKVoUCjEXe2FcNUZZUEzVloKGHGJtdAZIJPnC6BaEvHmLu5kFZ1LXd5No5PlNVrXFOGxqfpUMqmZZt1NQfp%2b0A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787941381&P2=404&P3=2&P4=WErSYzuyHc2TV%2fnXEos%2bQAUaYGzJSU466ql8bff5%2bfp1t5SfVhgirYhTyIcMvN7nqMraEXGn7gDjN5%2fVDO%2fONQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

w.ua
schemas.microsoft.com

Embedded IP addresses

20.184.175.3
40.84.85.40
4.230.171.124
4.144.132.114
104.46.162.231
74.178.76.128
20.165.94.54
20.231.239.246
40.99.134.2
52.123.128.14
52.123.129.14
52.168.117.168
135.233.45.221
172.66.2.5
52.123.252.230
203.26.79.13
52.148.114.188
52.123.252.219
20.165.94.46
52.168.117.171
51.105.71.136
72.154.7.109
52.110.12.53
52.110.12.31

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report