MALICIOUS — e9fa369d5bf84db591cb2197a311ff2c78760d6340b9af048b00d88e34a0b4ae

MALICIOUS — e9fa369d5bf84db591cb2197a311ff2c78760d6340b9af048b00d88e34a0b4ae is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e9fa369d5bf84db591cb2197a311ff2c78760d6340b9af048b00d88e34a0b4ae
SHA-1: f2419aa9f973d770adf05c92f3363e7785bd1dd4
MD5: f026b875b793b92d2a7e6a8c26b441db
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dH0fcDBkipRdInnZ4eaq8LXzpoyBTlZLTP:Qoa1taC0jcD3dBdqEpoyBh9
TLSH: T1395A23865619670CE2F2C9407D2D166E8841D8F7A3B8198E828FF14EF7CF66778101A7
Submitted as: e9fa369d5bf84db591cb2197a311ff2c78760d6340b9af048b00d88e34a0b4ae
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\EE91.tmp - 0f3a7088ec9294d77375dccc1a33f7547c3320aab6c0d2a892fdfbc86a623905
1f4c4949bd32728c6f40c36de0fe95894a4026b15dc6b91c1afd1e6cf392614d - 1f4c4949bd32728c6f40c36de0fe95894a4026b15dc6b91c1afd1e6cf392614d

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787828170&P2=404&P3=2&P4=L8LPc%2boD5lPgpwuWqrNpOnExaEBmCT%2bZE505paxxtF%2fYlE3I01l6gNZHvUmPQnLEXcvvtl190vOyN8AMKkGcnw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787828256&P2=404&P3=2&P4=VIB%2bYe%2fb%2fZYE6qvIUKVY9jdp3SFH6jnXVeS%2bH%2ftDmsnkURVgZxhbvFYlcl%2fIR9kDf%2fnMzANZn6Wc7RldNOwmbg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.73.28
52.123.252.198
4.230.171.124
172.215.188.225
20.247.184.197
57.155.101.212
20.165.94.63
40.79.167.9
20.165.94.54
104.208.16.94
20.76.201.171
52.123.129.14
52.123.128.14
52.123.252.223
203.26.79.13
92.223.78.30
135.234.160.246
20.165.94.46
52.148.114.188
52.110.12.54
52.110.12.18
20.42.179.204
72.153.5.138
74.179.71.159
52.110.12.50

File paths

o:\A[

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report