MALICIOUS — 1361b202a1131e1219bead42eb6d8035d00d2d228c9e35b937f2b665adb6b513

MALICIOUS — 1361b202a1131e1219bead42eb6d8035d00d2d228c9e35b937f2b665adb6b513 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1361b202a1131e1219bead42eb6d8035d00d2d228c9e35b937f2b665adb6b513
SHA-1: 56a0706a187238f7465a42a565f5f4da56e5a642
MD5: 5d59cfcfec36c96aeec0d3d41fc39214
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFb2UMxDH4Wv+sKeUYYHyGc:O+K88uPCH52UMtnLQyGc
TLSH: T1C45A23D952268B49E7F2C5903C18126E5001E9D68B7809CD528FF12D37EB97B743229F
Submitted as: 1361b202a1131e1219bead42eb6d8035d00d2d228c9e35b937f2b665adb6b513
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13789 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_fea554add12e4faa.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\2296.tmp - e7eb1a827e4ab972d383d6021e7d5ee11b2e25292d3843e6eba64a651dab8dc3
1909d9f7c449132cb030d4a452bdc7a9dcdeafbe844772cb23e457cfe642aa5e - 1909d9f7c449132cb030d4a452bdc7a9dcdeafbe844772cb23e457cfe642aa5e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

v.no
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.113
4.230.171.124
40.84.97.4
74.178.240.51
52.168.117.168
4.144.132.114
74.179.77.204
20.42.73.31
20.42.179.204
52.110.12.53
52.110.12.44
135.234.160.244
135.234.160.246
72.153.5.135
52.148.114.188
52.110.12.1
52.110.12.10

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report