MALICIOUS — 3baeee1ddacc7935bf634478f071038a13ee3e1765ac2412b98899da4e81feb6

MALICIOUS — 3baeee1ddacc7935bf634478f071038a13ee3e1765ac2412b98899da4e81feb6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3baeee1ddacc7935bf634478f071038a13ee3e1765ac2412b98899da4e81feb6
SHA-1: 20dbbcf697ff3710f596edb214ff4a74668af2f3
MD5: e0b669c87ba4e666220e178ef5d3ec5d
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFnIH/dPTnwWLbtOmd19E10UdettlPTyGc:O+K88uPCH21PDFPb19u7s5yGc
TLSH: T14B5A23C599295F09D2F2D590281A377E8442F8D6967C088B528FF02D33CB56B787229F
Submitted as: 3baeee1ddacc7935bf634478f071038a13ee3e1765ac2412b98899da4e81feb6
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\242C.tmp - 2d2f2bf3d75738ac2f46a7f4fe1184c6eed483b1fc8c6b6dc1ba9fd6b5ba81a8
f608da1538ce0b2377a0243b71e8ed6f549ad232e7aa311d07b50dcc994603c7 - f608da1538ce0b2377a0243b71e8ed6f549ad232e7aa311d07b50dcc994603c7

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787887888&P2=404&P3=2&P4=P7P%2fTmnF8SojgaLQmErrtbs42I8B%2fikATuMVmobIqOOkCNEm9Vyyvt0xZRDx8jYQFz265Sn%2f77%2bcJYi%2baIJxPQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787887963&P2=404&P3=2&P4=UH0VLS%2fCzho8VU4aLYkZJxXfQPW%2fJ1g7urMXcW2vdVEGMYoy3XDhGB8iSs2PWIU8rC7gUujE0JpvGD96i6TU4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.50.201.205
4.230.171.124
57.155.104.224
52.230.60.54
74.179.77.204
74.179.77.164
20.42.72.131
52.123.129.14
20.236.44.162
52.123.128.14
40.99.133.242
40.99.134.2
135.233.45.222
52.123.252.246
203.26.79.13
40.84.85.40
52.148.114.188
52.110.12.38
52.110.12.10
52.123.252.192
74.179.71.159
72.153.5.60
52.110.12.56
52.110.12.11

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report