MALICIOUS — 379e1cd61e70b196b40dff574698ecf634e5d4d8ab9653f74a28ec6a9c92df25

MALICIOUS — 379e1cd61e70b196b40dff574698ecf634e5d4d8ab9653f74a28ec6a9c92df25 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 379e1cd61e70b196b40dff574698ecf634e5d4d8ab9653f74a28ec6a9c92df25
SHA-1: 008535340d16dc5557c5482b56decef4863b7438
MD5: 9013b669dba78262832053835c0eccd4
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF9ORc560wLxuO0bPv78GxsR2cSHpywyGc:O+K88uPCH/8cJwJ0bHgGxsYywyGc
TLSH: T11A5A23865B159B0DF6F2D5802809666EC442F8D9837C19CF428FF21D33EB967B06219B
Submitted as: 379e1cd61e70b196b40dff574698ecf634e5d4d8ab9653f74a28ec6a9c92df25
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E7F9.tmp - ea254ed467cce641babd97c0c249e2cabfdde6cc61f05db99b39469d2f1e21a1
5f5566a14e653f60b9d6e651de18ee95abbc6935a0682e12f510885ae03720c9 - 5f5566a14e653f60b9d6e651de18ee95abbc6935a0682e12f510885ae03720c9

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808414&P2=404&P3=2&P4=g0QxTi6zTi27TGIP1TfB06wASaJcUe9qzJa%2fyQNNO2peRPBYfnOB3gXDQm87e4VtrKGOoK2l7QBJft4mrvHGPg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787808469&P2=404&P3=2&P4=grXbeNEFbBb8AcBgb81K4L4%2fAHrBvwbH%2fEy7jM%2fLS5EpM%2biAQ66QK7VZcTPgpCvQJcCT%2foZYObNHYoSaxsh8lA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.91
20.247.184.142
20.42.179.192
57.155.104.224
20.165.94.63
135.233.95.135
104.208.16.94
20.231.239.246
52.123.128.14
52.123.129.14
135.233.45.222
4.230.171.124
20.165.94.46
203.26.79.13
52.148.114.188
172.66.2.5
125.56.205.17
125.56.205.122
92.223.78.30
48.211.4.16
72.153.5.131
52.110.12.53
52.110.12.44

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report