MALICIOUS — 0a0995f8de22fd606bb588738c2bbe28857db5362a2cdb69d7fd52049c6d9918

MALICIOUS — 0a0995f8de22fd606bb588738c2bbe28857db5362a2cdb69d7fd52049c6d9918 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0a0995f8de22fd606bb588738c2bbe28857db5362a2cdb69d7fd52049c6d9918
SHA-1: c660711962a1fd28b14ee4daff98cc5d81b0ad8b
MD5: f40395b32515f13c4ad43351701bb179
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d4WyFGyZw6Ac/Kye43kVPlM2UnGN/:Qoa1taC0xWyL3doVgy/
TLSH: T1D85A239AAA59A70CE3F6C0402D29216DC881D4F7973829CF429FF05EB3D7967A8110D7
Submitted as: 0a0995f8de22fd606bb588738c2bbe28857db5362a2cdb69d7fd52049c6d9918
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\9020.tmp - 7861eae5a646876a53ba57746bd571a035efc3e73d609192b3a55ae3fcdece1f
43c76585a9065e2b342510d4566d3472123552c181915e5a15f54d9eaeff079e - 43c76585a9065e2b342510d4566d3472123552c181915e5a15f54d9eaeff079e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787768341&P2=404&P3=2&P4=YR5mNawN8cBS6RZzO0nZNgNgMIUNaH4hJxuDLCByZSRvwC33PnbjFHQtHVFTafNA0lz%2bTTFbCkUV%2bh9W7HMe%2fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787768365&P2=404&P3=2&P4=mau0Edj1%2bCabzNqEPK5y4RGYEOTVlL3W5e71xADErC0hx8xTNr8iVvMnwSM0GgdWrbxrpmdQtayrWcoMoKs6KA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.73.27
20.247.184.142
4.247.188.224
4.230.171.124
74.179.77.204
20.165.94.54
20.42.65.89
52.123.128.14
20.112.250.133
162.159.142.9
40.99.133.242
52.123.252.213
172.178.240.161
203.26.79.13
74.179.71.159
52.148.114.188
52.110.12.26
52.110.12.42
142.250.183.35
48.199.12.1
72.153.5.136
52.110.12.47
52.110.12.46

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report