MALICIOUS — 573e99d74fa5098076c9b9be1b4014e8717fa657da20a5336339f1397dc17179

MALICIOUS — 573e99d74fa5098076c9b9be1b4014e8717fa657da20a5336339f1397dc17179 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 573e99d74fa5098076c9b9be1b4014e8717fa657da20a5336339f1397dc17179
SHA-1: e64a0a8b1b77df8af0b5405178a681ec0f0b537c
MD5: 8d99e17385cbb25f64cd40f32e16c581
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dj5PPh+YyCvFFyvWyD3Kik1DZi:Qoa1taC0SPPoYFFyuyD651I
TLSH: T1095A234A46196B0CD2F6C1852D28265EC482D4F79378198F928FF19EB3DF96B38101DB
Submitted as: 573e99d74fa5098076c9b9be1b4014e8717fa657da20a5336339f1397dc17179
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\B21.tmp - f0768fa78d3a3b9360949ef5695d97acb5505d81087471fb5f858c79fb33790a
8c60ae7f88a4e113cd1454bec2228fa2010ed9e2388bbed876565b02e7a22269 - 8c60ae7f88a4e113cd1454bec2228fa2010ed9e2388bbed876565b02e7a22269

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808352&P2=404&P3=2&P4=WPqWqQhe%2fqEReo2vfrD0rJo1DOvm%2fCWDXC%2b%2fI7UCsIA3pHEL5l4bTaq2%2fzSSt%2f%2fYYV1MouED38x48aCkjySwKA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787808393&P2=404&P3=2&P4=YIL9M%2ba6LG4O6suEF6MjlcRLeB2FgbNlg5vuNZAtcU5KlKKoPquWrSz5MJ96fKtMQHs0GjDQikO79odVSMmXqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

d.se
29.no
schemas.microsoft.com

Embedded IP addresses

20.42.65.91
4.144.132.223
20.42.179.192
4.230.171.124
20.165.94.63
135.233.95.135
4.150.223.115
52.123.129.14
20.231.239.246
52.123.128.14
203.26.79.13
135.234.160.245
20.165.94.46
52.148.114.188
162.159.142.9
125.56.205.17
125.56.205.19
72.153.5.131
20.42.73.28
48.199.12.1
142.251.222.227
92.223.78.30
52.110.12.33
52.110.12.1

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report