MALICIOUS — 50038a712e6278be5905bbcf43e6199bdc4d4f72f942638cc843be1cd1d3029a

MALICIOUS — 50038a712e6278be5905bbcf43e6199bdc4d4f72f942638cc843be1cd1d3029a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 50038a712e6278be5905bbcf43e6199bdc4d4f72f942638cc843be1cd1d3029a
SHA-1: 5225d74e04002c33cde9842e3459154a490fe041
MD5: 73862098ffed189363de46d86c830e8a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dfVmlA0N1sEvHQuY36n3iZaauLh:Qoa1taC0eVp0N1sMUh+h
TLSH: T1595A2356595D670CE2F6C5803D24222E8441E8E79378288F91CFF10EF7DAA6B782119B
Submitted as: 50038a712e6278be5905bbcf43e6199bdc4d4f72f942638cc843be1cd1d3029a
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\684A.tmp - 015a2e04a6cc72c512c38633f80e407363a69e1988c2113828c176a080f4753a
9cb0d1250dcd535350d89882c064379f2a63982b121c9ba805a6b60a1a5cd830 - 9cb0d1250dcd535350d89882c064379f2a63982b121c9ba805a6b60a1a5cd830

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788163589&P2=404&P3=2&P4=dFhhxTdGepKzYkncVp53TfxhvVi59XiBV7Atl0pTJgrFYwKEvFDdcmlKz0DP8GGaIAnfUKQFX2hONVTnhrQXSg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

7i.ai
2.pl
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.103
52.123.252.218
4.230.171.124
57.154.63.210
52.253.84.76
20.42.179.192
20.165.94.63
135.232.92.97
52.168.117.171
4.150.223.105
104.18.33.89
135.233.95.80
203.26.79.13
52.110.12.14
52.110.12.46
40.84.85.40
20.184.175.3
20.42.73.24
52.148.114.188
72.154.7.103
52.110.12.38

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report