MALICIOUS — 30a0df0ada3f0480fca2c3cf88ee3bfa24da49edf1a21e04951be977011042c7

MALICIOUS — 30a0df0ada3f0480fca2c3cf88ee3bfa24da49edf1a21e04951be977011042c7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 30a0df0ada3f0480fca2c3cf88ee3bfa24da49edf1a21e04951be977011042c7
SHA-1: 2a78d9fee90479935da2905b5658169bc2e164a5
MD5: 1f0ae447b2d91dcdf6603f3c42904ab8
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFJx7Vqbc/gRKKwNnkiJnptyGc:O+K88uPCHvbLeaVdptyGc
TLSH: T1B95A2386A6299B4DE3F6C691380933AEC042F4C796B8488A418FF11D73DB5BB743115B
Submitted as: 30a0df0ada3f0480fca2c3cf88ee3bfa24da49edf1a21e04951be977011042c7
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\27E6.tmp - 3fa1b2dd96b56736874b2244c538741e5bd6fe32c2d699e5b54062bd3ddae793
f001db04a209dac42decb21a704e8e65edb6171edb6fa767aca1d1a6f08678fe - f001db04a209dac42decb21a704e8e65edb6171edb6fa767aca1d1a6f08678fe

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787856671&P2=404&P3=2&P4=R1WP4aqno1nG%2fK2WRz%2fD4MUM1JuM33Ds3NkARA%2fp1sLUt64agyFrI0eUt%2beDUbdrAWckHCkXUN7KMYwbsiDE1g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787856718&P2=404&P3=2&P4=BFjkH5yAvSYBUtlb0xwGj8%2bqE8xCrRmv1Ul%2bYvqdg9hTuO%2b2vFrQ5aIQe2tBdBcdacWGUZ3F8rtUvLvewDol4Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.12
4.230.171.124
40.84.97.4
52.230.59.222
74.179.77.204
13.69.239.69
74.178.240.51
20.165.94.63
20.76.201.171
40.99.134.18
52.123.128.14
20.42.73.31
135.234.160.244
203.26.79.13
74.178.232.29
162.159.142.9
52.110.12.37
52.110.12.45
85.210.193.152
52.148.114.188
72.153.5.97
52.110.12.20
52.110.12.49

File paths

y:\oI}

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report