MALICIOUS — 070e9e21177e5f9d876a17d64334c2567199523b338ce3525c54c3d248e7c8e3

MALICIOUS — 070e9e21177e5f9d876a17d64334c2567199523b338ce3525c54c3d248e7c8e3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 070e9e21177e5f9d876a17d64334c2567199523b338ce3525c54c3d248e7c8e3
SHA-1: 3e86aeea7d8dd70c18f3928c5406c8e27dbd45fa
MD5: ac275dddaf4d04e3cfdea05c7ff3e92e
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFFh13OxqSyn5Zs74ySrxHP4a+uzl1PVyGc:O+K88uPCHzQ05C4yel4a+u51tyGc
TLSH: T1985A22C156269B0EEBF1D9502C19267EC442F8D64BBC198A028FF02E73EB577643215B
Submitted as: 070e9e21177e5f9d876a17d64334c2567199523b338ce3525c54c3d248e7c8e3
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\BED6.tmp - 8447a706c7641156b16cf9e2d5b026c9d6eb251a6588489b0b911d74dd5c1921
f1050b3a7f90d62ee6b6c569587b64a7d80274d2eb1f3bf16aa700735c8f8782 - f1050b3a7f90d62ee6b6c569587b64a7d80274d2eb1f3bf16aa700735c8f8782

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787847082&P2=404&P3=2&P4=Picpkdr2DnSd73fLz7O2%2bJqiQWCjhy3NuLqYuVEiCAdshz06MsUKUlsSPA%2bQG3MoaDZfD%2fv7nDCAuIQhuQn9sw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787847163&P2=404&P3=2&P4=aKsFNE4wKlr4TqrjVx5XK42s9L4oUo4b2FnxSMc3KPMWjQleo6pKWqaIhGhkc1WY%2bonAZeUb8y3eNC8CzUBFqA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

40.79.150.123
52.123.252.218
57.154.63.210
4.230.171.124
52.230.60.54
135.232.92.137
20.42.73.30
74.178.240.51
20.76.201.171
52.123.128.14
40.103.64.226
40.99.133.242
52.123.252.226
57.155.104.224
135.233.45.221
203.26.79.13
52.123.252.230
135.232.92.34
52.123.252.227
52.110.12.26
52.148.114.188
51.105.71.136
92.223.78.30
72.145.35.98
52.110.12.32

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report