MALICIOUS — 274bb2dfcbe6b5e39386d8972ae51749fafb59d2fd97e9d57fdf65d3623653d9

MALICIOUS — 274bb2dfcbe6b5e39386d8972ae51749fafb59d2fd97e9d57fdf65d3623653d9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 274bb2dfcbe6b5e39386d8972ae51749fafb59d2fd97e9d57fdf65d3623653d9
SHA-1: dbabf51febc7610bf0867bbaebe043009c68a53f
MD5: af492af90bdd11ee57e50ea5cdd158cf
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFKBMVRBTOmf5buiEAKKzKBXIL7o/PyGc:O+K88uPCHdd5CsKKzAtPyGc
TLSH: T1C85A23DA9A1A5B0DE2F2C44028093B7E8542F4D6967848CB528FF01E73EB577743216B
Submitted as: 274bb2dfcbe6b5e39386d8972ae51749fafb59d2fd97e9d57fdf65d3623653d9
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12934 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_baca16c0374944ec.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\E53.tmp - f5dad76531181a6ccca87c6fe0048d487c360fb0caad3c86edcb33ed1d952705
0d396e975dfbbe1050cca67746ecb9700f27e55db2651c9d770718328712955a - 0d396e975dfbbe1050cca67746ecb9700f27e55db2651c9d770718328712955a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

j.cn
0j.br
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.207.44.69
52.123.252.236
4.230.171.124
4.144.132.114
85.210.193.152
85.210.196.11
74.178.240.51
4.150.223.107
57.155.104.224
20.165.94.63
4.150.223.102
74.178.76.128
48.211.4.16
135.233.45.222
72.145.35.97
52.148.114.188
52.110.12.11
52.110.12.47

File paths

V:\t

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report