MALICIOUS — 27a2a005a42b639869b6e074d8bbc17d8881f0d1b16c70a99ee2384b49fee415

MALICIOUS — 27a2a005a42b639869b6e074d8bbc17d8881f0d1b16c70a99ee2384b49fee415 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 27a2a005a42b639869b6e074d8bbc17d8881f0d1b16c70a99ee2384b49fee415
SHA-1: 9e1e383eb9d93efbcb443effb6cc18464ad497f7
MD5: 1116f6192dd2c4d6e22316e6e125583c
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFbMiEyDYronwGA6aUj/P2pQ/yGc:O+K88uPCHiiE4YrlGA6xLyQ/yGc
TLSH: T10D5A238596295F0CEAF1C540381A226E9581F4E6967C08CF828FF11E73DB62BB47315B
Submitted as: 27a2a005a42b639869b6e074d8bbc17d8881f0d1b16c70a99ee2384b49fee415
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9395 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_74c5ae9584c249db.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\3999.tmp - ff4c04d9722d12972e7a0e731bb6aef003a9cbd0eb2f3d7fe1418eac37aaa261
f49eac175db06c2f3351e3ee79b951172ae61e5c16247e569d33f70325cdf40b - f49eac175db06c2f3351e3ee79b951172ae61e5c16247e569d33f70325cdf40b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.105.71.137
4.230.171.124
57.154.63.210
4.144.132.223
135.232.92.97
135.233.95.144
4.150.223.110
172.64.154.167
74.178.76.128
4.150.223.107
13.69.239.69
92.223.78.30
125.56.205.65
125.56.205.26
57.155.101.212
72.145.35.97
52.148.114.188
52.110.12.44
52.110.12.22

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report