MALICIOUS — 3be1cb81e23c98a36935f4b753269d8f12b86fabc592e16d03d6a0d5640e659d

MALICIOUS — 3be1cb81e23c98a36935f4b753269d8f12b86fabc592e16d03d6a0d5640e659d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3be1cb81e23c98a36935f4b753269d8f12b86fabc592e16d03d6a0d5640e659d
SHA-1: e9d6f2bd5702a47dec21050df00b7ec591618dbb
MD5: d0c31c1dd12c4cbba4d61725cc060617
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:WFUcx88PWPOpX0SFn8B8aQtazWU9aYbG/dyGc:W+K88uPCH6B8aQWWrYsyGc
TLSH: T14F5A23865A298709E3F6D4903C2627BE8042E4D69B7C06CB828FF12D77EB9677031157
Submitted as: 3be1cb81e23c98a36935f4b753269d8f12b86fabc592e16d03d6a0d5640e659d
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100)

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): HEUR:Backdoor.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Generic (rule HEUR:Backdoor.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

9412 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\7913.tmp - 15af33ac8abcb495e92e9cbca633ee9fae08e89fd44c8171c77dfa5a8f15d438
c:\users\analyst\appdata\local\temp\tsk_f5439966b43b4ba3.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
0179852e550d4f3563e10740f5bcde5542f0c9a83eece7acc034464036d17976 - 0179852e550d4f3563e10740f5bcde5542f0c9a83eece7acc034464036d17976

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

za.ch
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.8
4.230.171.124
20.247.184.142
40.84.85.40
74.179.77.164
135.232.92.137
4.150.223.99
52.182.143.212
74.179.77.204
52.110.12.45
52.110.12.19
172.64.154.167
125.56.205.24
125.56.205.123
72.153.5.96
52.110.12.49
52.148.114.188
52.110.12.3

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report