MALICIOUS — 2ea126f37b6dadcc3d740a7b066a68e11573984d0565ef6f315b5033f4e20b7a

MALICIOUS — 2ea126f37b6dadcc3d740a7b066a68e11573984d0565ef6f315b5033f4e20b7a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Zusy family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2ea126f37b6dadcc3d740a7b066a68e11573984d0565ef6f315b5033f4e20b7a
SHA-1: 640f341960ce6f0b1d8b4c8eef34d7426011884e
MD5: 00227e03a06d365f1679376e42e2714d
imphash: e07989e77f93c45ef3b9da49cc5892a4
ssdeep: 196608:qSthaA8QIG7jiL5ljruRK6pPRciXsirlSeCqMzOjOM:iaIG7jiFlH03AnmOM
TLSH: T1C96B23D6F4D4AE87D6008C595223407EA23A8BC33269BEE2F4D4F93685DC0E75E216D1
Submitted as: 2ea126f37b6dadcc3d740a7b066a68e11573984d0565ef6f315b5033f4e20b7a
File type: pe · Size: 9932512 bytes
Verdict: malicious (97/100) · Family: Zusy

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Emsisoft (Emergency Kit): Gen:Variant.Zusy.468277
Kaspersky (KVRT): UDS:Trojan-Downloader.Win32.Agent

MITRE ATT&CK

Why this verdict

The malicious score of 97/100 is the fusion of 11 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections:.vmp1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

35466 behavior events · 2 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db - 723ef109024a7d1b03e6335ee53d0140027b2224765fe5fed23d1b07906a03a6
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db - 65df25d47314d40ab260c9c553e84acd989bf1086208db3aeb582518530e4cfd
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db - b8fef4cf3fc4880f9954a9ed20cc210cb3237d956250d3aa80c1679d991a8cdb
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - 2efbbb94db3f265d45db763ff8d6d5b35bec27b1c085a5ed20555cec31d4fc8e
C:\Users\analyst\AppData\Local\Temp\DgGMlx.sys - 4391e4b30dd1b3b8e4a9d209d6e3f3187bbdbfef3effc61e5e9edf5f1501e726
4a38764de6c4a4bd4633dde255a14d6ae333963101f76ad248a2aa08cfb4fbf6 - 4a38764de6c4a4bd4633dde255a14d6ae333963101f76ad248a2aa08cfb4fbf6
00b0d96ab5d8e881ea6e71187b8f5a9eed5ab72ac4df950e9890799c78e1d5cb - 00b0d96ab5d8e881ea6e71187b8f5a9eed5ab72ac4df950e9890799c78e1d5cb

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://pic.rmb.bdstatic.com/bjh/e7cc2bdf04ec36188e6c6869c73b630f.png
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787935025&P2=404&P3=2&P4=LniBNWwoGcAR9h40ZYso4jeOVGBwB5rzrafpT274hTFP9VOQyZSpda8E3d6Ongy10Vs5%2b2pzIf%2bktwUY9jmtxQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787935135&P2=404&P3=2&P4=c7gqU7FSWf1pgQ77dvQlVIH9XWES6vx4MHCvS1F65KLz2%2fHqUSlmuigI2fNexcQn6nRSPJH%2bgFvJKpEw%2fkMvOg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

dc.mx
ns.adobe.com
www.w3.org
purl.org
www.iec.ch
dxllyfxzof.bbyyjy.com
pic.rmb.bdstatic.com

Embedded IP addresses

20.184.175.12
4.247.188.233
4.230.171.124
20.247.184.142
74.178.76.128
20.42.65.88
74.178.76.54
20.236.44.162
52.123.129.14
52.123.128.14
20.42.65.94
135.233.45.221
52.110.12.18
52.110.12.31
52.123.252.213
61.147.237.35
135.234.160.245
203.26.79.13
52.148.114.188
74.179.71.159
52.123.252.203
72.145.35.111
52.110.12.14
52.110.12.33

File paths

U:\^oB
Z:\nh
U:\C
O:\6i

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report