MALICIOUS — 495254773f08e81a793e479fd9a50f3074f0d5536a2430136dff537cdb9855bd

MALICIOUS — 495254773f08e81a793e479fd9a50f3074f0d5536a2430136dff537cdb9855bd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 495254773f08e81a793e479fd9a50f3074f0d5536a2430136dff537cdb9855bd
SHA-1: 35c628853e792e4791f25ded4eaf3af87dbba373
MD5: 87304721623331af568cd5705a346cdf
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d6qLg3P3qCEtetoNLHumX04Mz4:Qoa1taC0Dq2iCEtxNL90d4
TLSH: T1835A238A6A59770CE6F6C1803E69112EC541D8E7533C298F828FF05EB7DB46734211AB
Submitted as: 495254773f08e81a793e479fd9a50f3074f0d5536a2430136dff537cdb9855bd
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\46D7.tmp - 65e043de5b1b349222d723b6ce02044d5e91d5d27f79089ed2e4afe65e4f0e85
2ab3137d863e1914d3c940c2b15b0dc589d0b19ee1ab277bb98fb0ff8f94b4ac - 2ab3137d863e1914d3c940c2b15b0dc589d0b19ee1ab277bb98fb0ff8f94b4ac

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787811058&P2=404&P3=2&P4=UtmCu%2b5yyMscWljGh%2bGt6SCdELybt921htL6h7iO2hMrK4RHMO4BI9AeRThvK0t15fG2%2bZPFbdV4EnwCt2iAow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787811100&P2=404&P3=2&P4=RBrCe70S8CCto9I%2f09aKdMTMSEZa47NzcrY9AUvsFfUKJUnXHsGG%2b8K3A4ukvJILh4XU5K0DGl5CVvLEDhI%2buA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.84
52.123.252.232
4.230.171.124
172.215.188.225
4.144.132.114
74.178.240.61
20.184.175.9
74.178.76.54
40.103.64.242
20.112.250.133
52.123.129.14
52.123.128.14
40.99.134.18
20.184.175.21
203.26.79.13
135.234.160.246
20.165.94.46
52.148.114.188
125.56.205.49
125.56.205.17
72.153.5.141
57.154.63.210
92.223.78.30
52.110.12.32
52.110.12.33

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report