MALICIOUS — 59d5e623e6442b78ffc77b1c7f5bb6a9242046993839e873169d8e76c0e0e494

MALICIOUS — 59d5e623e6442b78ffc77b1c7f5bb6a9242046993839e873169d8e76c0e0e494 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 59d5e623e6442b78ffc77b1c7f5bb6a9242046993839e873169d8e76c0e0e494
SHA-1: 6d55de401bdb82c6bda0078da3e6b65247b2e4af
MD5: f034bb24d5a3992d907b55936402dcff
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF12FfQXvK7fSCkHnNcLYyGc:O+K88uPCHGFY/q9kHNcLYyGc
TLSH: T1255A23C69E295B09F3F2D0802829276EC481E5C297BC598E538BF12D73DB56B243116B
Submitted as: 59d5e623e6442b78ffc77b1c7f5bb6a9242046993839e873169d8e76c0e0e494
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12916 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\F387.tmp - 019d123d44e069dff72b8aed7b62a46b883ca310a9337107803560b97dbfd6e9
c:\users\analyst\appdata\local\temp\tsk_d819009e2c4e4bb2.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
a3114b22d6e6fe0e10278f454e02d10425dc9226de8ee6f7b118fa934cf2fd92 - a3114b22d6e6fe0e10278f454e02d10425dc9226de8ee6f7b118fa934cf2fd92

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

gk.ly
schemas.microsoft.com

Embedded IP addresses

20.50.201.203
52.123.252.229
4.230.171.124
52.230.60.54
40.84.97.4
104.46.162.224
104.18.33.89
74.178.76.54
74.179.77.204
20.42.65.88
20.165.94.63
85.210.193.152
20.42.179.192
172.66.2.5
52.110.12.16
92.223.78.30
135.233.45.222
40.79.150.120
52.148.114.188
72.153.5.132
52.110.12.42
52.110.12.8

File paths

h:\C

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report