MALICIOUS — 43eed8d7d993ed5d3b45c2862f4c68ecda873794aa96cc1c580489a57c0733c1

MALICIOUS — 43eed8d7d993ed5d3b45c2862f4c68ecda873794aa96cc1c580489a57c0733c1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 43eed8d7d993ed5d3b45c2862f4c68ecda873794aa96cc1c580489a57c0733c1
SHA-1: 4e929de5a2d1015d48bc0b38e1272bee4e459b5e
MD5: dcec2975795831e5759a434824da8785
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFv1Kvnajm1eqXbAZAt+nsu6xmqmsy1yGc:O+K88uPCH91KvnFsqeAtNu6xm9sy1yGc
TLSH: T1AD5A238AA6294B0CE3F2D5416819276EC080B4E393BD49CA528FF11D33EB977746125F
Submitted as: 43eed8d7d993ed5d3b45c2862f4c68ecda873794aa96cc1c580489a57c0733c1
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12882 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_3edceedcda6d4ad3.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\2A08.tmp - b0513210122e81e337db0b25f2b2b82651528db713ad728f20eac68c4439f93c
b40391e7a550864040e63dc15e107a74d381c4f07b3324746263891690b2e8f0 - b40391e7a550864040e63dc15e107a74d381c4f07b3324746263891690b2e8f0

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ea.nl
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
4.230.171.124
20.42.179.192
74.178.240.51
4.247.188.224
52.168.117.170
4.144.132.114
74.178.240.61
13.89.179.15
74.179.77.204
172.64.154.167
4.150.223.100
51.105.71.137
135.233.45.223
52.148.114.188
72.154.7.112
52.110.12.26
52.110.12.10

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report