MALICIOUS — 6f613e6826122fef5d8a86c9c9dd2db91e02602234d81395ffeccae382004ae2

MALICIOUS — 6f613e6826122fef5d8a86c9c9dd2db91e02602234d81395ffeccae382004ae2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6f613e6826122fef5d8a86c9c9dd2db91e02602234d81395ffeccae382004ae2
SHA-1: f5b7059a0eee935483108a2f8504232134f5d826
MD5: 0359496f41e0fb87f61fc2c521736bf0
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFEbkfAU4NYYJtyjZLIKm5rp/kOdDpYQyGc:O+K88uPCH2gfklt++L/k6lyGc
TLSH: T1A35A23C56A189B0CE6FAD0902C2957AE8501F8D69BBD088E938FF12D77CB427743115B
Submitted as: 6f613e6826122fef5d8a86c9c9dd2db91e02602234d81395ffeccae382004ae2
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\12A3.tmp - 659c98d79fa3662814f371cb24da582c154d1ec4a6217cd097bf241c194fc9a7
86917ab1b906376746276f261aefcdb785824643f67d6542f1e9124054fb73bf - 86917ab1b906376746276f261aefcdb785824643f67d6542f1e9124054fb73bf

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787921471&P2=404&P3=2&P4=ErTXr1YbLNWiNSwnJkpUjjAfzDKaohTcywhRrwJmUBQ3QojjB2oLqpk%2fVMLARMxEzuoKym35WUVhsMzUTAwFrg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787921570&P2=404&P3=2&P4=JxmW5LKBThknzWXGbZy2tCXqiM%2bY12jqexAvUAvSyTxd%2fdWMZQcGByd3ktKsDXYUDxPFai73LAOC9KOt%2fVzbLA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.111
52.123.252.194
52.123.252.244
4.247.188.233
4.230.171.124
20.247.184.197
135.232.92.137
135.233.95.135
51.116.253.170
4.150.223.109
20.231.239.246
52.123.128.14
52.123.129.14
172.66.2.5
203.26.79.13
52.110.12.5
52.123.252.240
52.110.12.18
172.178.240.163
52.110.12.56
52.123.252.204
20.165.94.46
52.123.252.248
52.148.114.188
20.42.179.192

File paths

b:\0

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report