MALICIOUS — 5326161485b78a388d2dbc7e1f8187a0038126909d6ece61b6d3e90865934d92

MALICIOUS — 5326161485b78a388d2dbc7e1f8187a0038126909d6ece61b6d3e90865934d92 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5326161485b78a388d2dbc7e1f8187a0038126909d6ece61b6d3e90865934d92
SHA-1: 8f193b467a5dfb4ddbcf5f343505ba4b3b18fbc5
MD5: 06edaf22fe012a26d6674037753f5fc8
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFmh5CwmDcP8Lx5xeU4gbra9Ba+/9qkkDyGc:O+K88uPCH4QwmDc0dreUjvQBa+FIyGc
TLSH: T1545A238199259B4AE3F2D440381A367E8442F5D296BC5ECA528FF11E33C7977347218B
Submitted as: 5326161485b78a388d2dbc7e1f8187a0038126909d6ece61b6d3e90865934d92
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\42EF.tmp - 53d3195e7cf329ea373b77ae679772a5ab402d0d7f8330478dbc3bdd9ceb0931
48c88897921285d37aecf60d97a348b0a20a8d2b79911c529494a648b0217a95 - 48c88897921285d37aecf60d97a348b0a20a8d2b79911c529494a648b0217a95

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787737280&P2=404&P3=2&P4=WoBVtqMs%2bE3dJCA%2bR%2bVYYYu%2byAqUhP3W6LCknFlhuMw9HVM3h2lpzpt6fcBz%2fZq%2fIh%2b%2fG87h7TYRhocwmM7EHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787737350&P2=404&P3=2&P4=Sx6%2bjn0EplrnG8yrb6hXD3wdlTh1tIYNZJmRs4TC1fOg6lth4uUnI6Yv8C%2b%2bL9WeFxY7bkIMCZ5utUET3AXrJA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

n.sg
c.tv
schemas.microsoft.com

Embedded IP addresses

51.104.15.253
20.247.184.142
4.230.171.124
57.155.101.212
92.223.78.30
20.165.94.63
135.232.92.97
20.42.73.24
52.123.129.14
52.123.128.14
20.236.44.162
40.104.4.2
51.132.193.105
135.232.92.34
135.234.160.244
52.110.12.31
52.110.12.26
203.26.79.13
52.148.114.188
48.211.4.16
172.217.25.195
72.153.5.129
52.110.12.24
74.178.232.29
52.110.12.49

File paths

R:\=c}

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report