MALICIOUS — 6beddcb7c8c26371a329fa9ffaaa96ee4ddad2a4271176aef17a48a2a96d1b92

MALICIOUS — 6beddcb7c8c26371a329fa9ffaaa96ee4ddad2a4271176aef17a48a2a96d1b92 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 6beddcb7c8c26371a329fa9ffaaa96ee4ddad2a4271176aef17a48a2a96d1b92
SHA-1: b96c3663c8910774d8b20b21171d0d1b09c00334
MD5: 6de2590a804c26030453613eb8278adb
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFg1pJSyQqKnnBdhvDeU6q35AvNiZEyGc:O+K88uPCH+TSoKBdg9YuyGc
TLSH: T1505A23C66A2C6B08E3F3D4903C2A566EC582E4D6877C488A524FF11EB3DB527743119B
Submitted as: 6beddcb7c8c26371a329fa9ffaaa96ee4ddad2a4271176aef17a48a2a96d1b92
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12321 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_92b35d470de74704.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\F0B9.tmp - 4421295c0c40123d8e5aad83ec6cec1232820f2c2c7b69cd669d0ed912a072da
adf763ee1e3f83b7be8d43e584e1320649bf8daec854e6ff68a8b4c85d3923ff - adf763ee1e3f83b7be8d43e584e1320649bf8daec854e6ff68a8b4c85d3923ff

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

5y.in
7.co
schemas.microsoft.com

Embedded IP addresses

20.42.73.25
4.230.171.124
48.211.4.16
52.253.84.76
74.178.240.51
20.89.1.13
20.165.94.63
135.232.92.137
52.110.12.14
52.110.12.28
172.178.240.163
20.89.1.9
52.168.112.66
135.233.45.222
172.178.240.162
57.150.192.97
72.153.5.141
52.148.114.188
52.110.12.24
52.110.12.1

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report