MALICIOUS — 38ebb322bda67afc95dcb67431e13c3b56a10d53d060fee3eec9af76872f135e

MALICIOUS — 38ebb322bda67afc95dcb67431e13c3b56a10d53d060fee3eec9af76872f135e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 38ebb322bda67afc95dcb67431e13c3b56a10d53d060fee3eec9af76872f135e
SHA-1: d6beb015903e5c90a2fcfae2956ce4e6b6513f8c
MD5: 283ef223e585164142c9b6771250b1ef
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dusmah+kMKd40np+d1ECy8DCr:Qoa1taC0umwVznp8er
TLSH: T1755A23465A166B0CE6FBC1403C29262EC442D4E3A37C298B918FF05DB7DB5AB7C1119B
Submitted as: 38ebb322bda67afc95dcb67431e13c3b56a10d53d060fee3eec9af76872f135e
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

151 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E0CA.tmp - 1a0fe0151384fc7ab0c887dad92c94a7017ce769f5492d1e8bc2f37af38248e7
2a2368c2573af7cdef505434cc837b487320042ba2399e8e46c4fae6a959995c - 2a2368c2573af7cdef505434cc837b487320042ba2399e8e46c4fae6a959995c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788019566&P2=404&P3=2&P4=R89QN4yxqVdTfDu0DaWA8wBr4E4pBODBTSISqRmxJ80qcDIt2%2bVZhG8TvJ8eD103eHjljdBzvSGFGtFut44V2g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

fo.se
schemas.microsoft.com

Embedded IP addresses

20.184.175.6
20.247.184.142
4.230.171.124
135.232.92.97
135.232.92.137
20.42.73.30
20.42.73.25
85.210.193.152
20.165.94.46
92.223.78.30
52.110.12.40
203.26.79.13
52.110.12.31
72.145.35.98

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report