MALICIOUS — 649f951c48f2fcf10afae8cc33568305cc21b05e6071dd558040cfb69715a077

MALICIOUS — 649f951c48f2fcf10afae8cc33568305cc21b05e6071dd558040cfb69715a077 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 649f951c48f2fcf10afae8cc33568305cc21b05e6071dd558040cfb69715a077
SHA-1: 3e5f70cb63ea5d06d81db701f5595ef9d20ef5b3
MD5: 03bd6d767fa83fd1fda9858eed53ae4f
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFTvbGh27QF5dB0yQqRUKksSO1/EyGc:O+K88uPCHdqhtPQqqK1IyGc
TLSH: T1E95A23C19A1A9B09E7F5D980380A277DC542E8D2C3B8068B528FF13E73DB567742119B
Submitted as: 649f951c48f2fcf10afae8cc33568305cc21b05e6071dd558040cfb69715a077
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E673.tmp - 96c567c54baca7adeb427b1d8bde1d84ed34cd0260808c90967465f5836f6b90
efa81bf6467ac596042468303dea0efb5945c76e5cbbb75e757a4c0bafc334e0 - efa81bf6467ac596042468303dea0efb5945c76e5cbbb75e757a4c0bafc334e0

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787727973&P2=404&P3=2&P4=bAqk9Dz5XzuAZGkbDVGPRZvQqXHp6Gxeb37yYtpQK1r%2bcBy0qLJaFAJyzToWXBKKVIaNGSr1eyRwZuFGhrB7eg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787728007&P2=404&P3=2&P4=OeCbbMFZoOF0OzTpwi%2f6qwXpqqQtUOjpReIHrKu6ufTvAJz9uuYbeYWTBijUisgSOxmTnWQIsuj%2bj4eXG1q4MA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.110.12.47
52.110.12.51
20.42.65.90
203.26.79.13
52.123.252.227
52.230.60.54
4.230.171.124
40.84.85.40
4.247.188.224
135.233.95.144
74.178.76.54
40.79.141.155
20.236.44.162
40.99.133.226
52.123.129.14
52.123.128.14
172.66.2.5
172.178.240.162
72.145.35.99
74.179.71.159
135.232.92.34
52.123.252.232
52.148.114.188
72.145.35.108
57.155.101.212

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report