MALICIOUS — 6b76b56e6386ed6641374e3956044d33a1d7614118a1a1d7925b011111db7a90

MALICIOUS — 6b76b56e6386ed6641374e3956044d33a1d7614118a1a1d7925b011111db7a90 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6b76b56e6386ed6641374e3956044d33a1d7614118a1a1d7925b011111db7a90
SHA-1: 90ca40bb0b4da62204699f8489b524c262c0ef8f
MD5: 26d14889c3eb36632537640525b1858a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFVqxOuyVfnFkXJSNQ5AJ1exxOgZ6/fTHkDnyGc:O+K88uPCHk7yVfnPhJ1eTOgZ6/WyGc
TLSH: T1015A23CA6A1A9B49E3F2D4813C1967BEC441E4C58778098E424FF12E73DB56734321AB
Submitted as: 6b76b56e6386ed6641374e3956044d33a1d7614118a1a1d7925b011111db7a90
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

102 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\16BF.tmp - 9d324d1a920aad333caf08e9566e10cb29839503df497cf6f5ef657c62131cd0
2bb5035b56aec91b3bc492a23fef43bd271841814858200045891d404ddd8305 - 2bb5035b56aec91b3bc492a23fef43bd271841814858200045891d404ddd8305

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787834486&P2=404&P3=2&P4=f43xjsTAhjJOMTISIQQK1Gguzfx%2bw%2fjIFcE%2f%2bMAL2u%2fPVF12aXjT0ZmUYfO3zOJ8YHnqft38KUZImOTEd20EmA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787834529&P2=404&P3=2&P4=i4HHeVmOrE5XU5SGsAcUVZK8V3vcgnw%2fdlaqLoleysCehYKHiPA4rhEThfWC1II8UZK%2f%2fbFSm751C%2bl9U7eZqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

3.me
sdc.ly
m.ml
schemas.microsoft.com

Embedded IP addresses

4.150.223.96
20.247.184.197
85.210.193.152
4.230.171.124
20.165.94.63
20.165.94.54
51.132.193.104
52.123.128.14
20.112.250.133
52.123.129.14
40.103.64.226
135.233.45.222
52.123.252.235
172.66.2.5
203.26.79.13
52.148.114.188
74.178.232.29
162.159.142.9
51.105.71.137
20.165.94.46
72.145.35.97
52.110.12.11
52.110.12.16

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report