MALICIOUS — 36a7107a99cedf3131fa7f9d3b881e82b91459a8b448996748f2459ea8515009

MALICIOUS — 36a7107a99cedf3131fa7f9d3b881e82b91459a8b448996748f2459ea8515009 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 36a7107a99cedf3131fa7f9d3b881e82b91459a8b448996748f2459ea8515009
SHA-1: 47d4b14fbf1d157f920230354c5518f4bc6d8891
MD5: b27b77cacdbf147a4d58a98f145f3de0
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dPILiW3ylPABfQ8zrPfApn:Qoa1taC0OILkGLrK
TLSH: T1925A239A96096B0CE2F2C4847C28112E8842E4B7937816CF52CFF05F7BDB967781159B
Submitted as: 36a7107a99cedf3131fa7f9d3b881e82b91459a8b448996748f2459ea8515009
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): 57B0.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\57B0.tmp - d6acb5e541ff9174c0a4c4daa8db03d40847a90cc2bca6243ddbe865a3c4e5ba
57a3d7ceebd333d85d0da0583b702dfae2894a63842856305ed845d4699926aa - 57a3d7ceebd333d85d0da0583b702dfae2894a63842856305ed845d4699926aa

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787447588&P2=404&P3=2&P4=AIOjtGi5MzF98FARptirBOT3UsrEQY8Ac9tlmeD4cZXnUaex4eGtCd122L480LKJSQQQEnEB7Ni%2b0vhDnUObEA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787447684&P2=404&P3=2&P4=XWMyTx866gWnScNJJvsZu%2bBJoyP6R0aTYTFbUM7vtyv5NTrkaJ0u47QwVuckPj6eT%2booTR2zibDQ2xFzoLAMWw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.174
52.123.252.242
57.155.104.224
4.230.171.124
4.144.132.223
135.232.92.137
51.105.71.137
74.178.240.51
135.233.95.144
52.110.12.54
203.26.79.13
92.223.78.30
52.110.12.4
40.99.133.226
172.66.2.5
172.178.240.161
135.232.92.34
4.150.223.101
52.148.114.188
4.150.223.96
20.76.201.171
135.233.95.80
40.84.97.4
52.123.128.14
52.123.129.14

File paths

v:\}^

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report