MALICIOUS — 3e8de46fa8d25edc29d390bfc22d1695f25de4f7b6b14875708e64e9cbc7f9ef

MALICIOUS — 3e8de46fa8d25edc29d390bfc22d1695f25de4f7b6b14875708e64e9cbc7f9ef is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3e8de46fa8d25edc29d390bfc22d1695f25de4f7b6b14875708e64e9cbc7f9ef
SHA-1: 7463734be2294ac0f85770c664860896d3289f62
MD5: 355c7767dfed4adae942a2bb25bcc76b
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFS9nYP0Ov9Nnm9PgSifd+ORihw3RSkIZyGc:O+K88uPCHUYMOv9GP5lERSNZyGc
TLSH: T1D05A23C19A2A4749E7F6C5503D0A2B2E8505E5D2877C4C8B924FF11E33C796B742229B
Submitted as: 3e8de46fa8d25edc29d390bfc22d1695f25de4f7b6b14875708e64e9cbc7f9ef
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12903 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_6cf28133e3f04bea.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\5714.tmp - f87f3d3a741246bff08c8410f8ccee295214d4184485835c283703dae6dc3a5d
c23455404a19af2b2a89bbb839ef2318e02700dccb206a9b0e81ed9c4c26eb2c - c23455404a19af2b2a89bbb839ef2318e02700dccb206a9b0e81ed9c4c26eb2c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
74.178.240.51
20.247.185.124
85.210.193.152
4.230.171.124
20.184.175.3
20.165.94.63
52.253.84.76
52.123.252.222
92.223.78.30
104.18.33.89
52.110.12.46
52.110.12.20
20.42.179.192
85.210.196.11
72.154.7.97
52.148.114.188
52.110.12.21
52.110.12.48

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report