MALICIOUS — 252360061cfcd68aa404164d07e85831ab57e78f77e1f31e7490a9ad3f0a8ba6

MALICIOUS — 252360061cfcd68aa404164d07e85831ab57e78f77e1f31e7490a9ad3f0a8ba6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 252360061cfcd68aa404164d07e85831ab57e78f77e1f31e7490a9ad3f0a8ba6
SHA-1: 33b833053245b7dfcd3390a181997e9646a0ba40
MD5: 3a231af6569866b0312e5379c4cd1e74
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d0CKjQZe5/r4k6zjoT/fcN:Qoa1taC0Xjye5/4joLfcN
TLSH: T1805A238AA209770DE2F2C5443C68266EC441E8EB6378198F818FF05EB7D795768111EF
Submitted as: 252360061cfcd68aa404164d07e85831ab57e78f77e1f31e7490a9ad3f0a8ba6
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A87F.tmp - af04e79724e55b7d4322bb054757bf110b3e343beb33571fc0e4d3e785475e71
cf93ed293a9a4ee3ac0a5d4dd452c99ed1b0fb7b84e3f296932121f4bfe32fcd - cf93ed293a9a4ee3ac0a5d4dd452c99ed1b0fb7b84e3f296932121f4bfe32fcd

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787952079&P2=404&P3=2&P4=WpqLB2%2bJeetBuOhb98WplgpxmWVS4Q5O%2fosuJozJyeSuWfUmlNb1tYTfzJxi4ZZYYcDsicG%2f6cGW4rB%2fTNBmAg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787952128&P2=404&P3=2&P4=C8TKYjCtRSBdmxzdzuFgt4mIBoCrsekWrGX2alQiBoRVYn6Bt8cYcqYzpn01Y4%2b81LHaNY7%2fPsrqARgV4SUm%2fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.109
4.144.132.223
4.230.171.124
20.42.179.204
135.232.92.137
20.184.175.12
20.165.94.54
20.231.239.246
40.103.64.226
52.123.129.14
52.123.128.14
52.178.17.2
203.26.79.13
135.234.160.245
92.223.78.30
162.159.142.9
135.233.95.80
52.148.114.188
40.84.85.40
72.145.35.104
52.110.12.37
52.110.12.47

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report