MALICIOUS — 71b908179335472855523a305e48f9f8c2d22a30b78ae154eaa0808009d0d378

MALICIOUS — 71b908179335472855523a305e48f9f8c2d22a30b78ae154eaa0808009d0d378 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 71b908179335472855523a305e48f9f8c2d22a30b78ae154eaa0808009d0d378
SHA-1: bf858db2e9c1459c343e91f1759945c44bf1a96d
MD5: c12987bd2f114f832c2bdbfe1124c34f
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d2FOQ9y5j7EO6Zqxy+eL9rX+oelHHfJG:Qoa1taC0vWj7QZUeLtOHlHHc
TLSH: T1205A23866A19670DF2F6C0847C5D166EC802E4A67338268F538FF05E73DB96738111AB
Submitted as: 71b908179335472855523a305e48f9f8c2d22a30b78ae154eaa0808009d0d378
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\40BD.tmp - 01e4f6656dae96d0bfc3ba996dd90ff5eeb1e6e217041c9cf7c257fb0b306bcf
c59dea39ff4a783a4f471d64d34b029b3c3336344d450fc05e3c9418ed653b43 - c59dea39ff4a783a4f471d64d34b029b3c3336344d450fc05e3c9418ed653b43

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787932325&P2=404&P3=2&P4=HqdMuhE4NoLzlGcq4qSST7QsiLNQORK0QcZCFpQNpY8k%2fPQhQmcPcs%2b%2fLchhqstI5pWvHygS1uE7SN7GF%2fHHow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787932405&P2=404&P3=2&P4=hU5NCfvMKySiDd0IvKNJ2H24Ofgf2hm%2btpS8uwoGFfJMP8B2%2f9UZ%2bMllqMMBMZLgtURgMaRUmJEmr%2fDRzY9S3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.1
4.144.132.223
20.42.179.192
4.230.171.124
74.179.77.204
40.79.167.9
20.165.94.54
20.112.250.133
52.123.128.14
52.123.129.14
162.159.142.9
135.234.160.246
52.110.12.10
52.110.12.4
203.26.79.13
52.148.114.188
135.233.95.80
57.155.104.224
20.165.94.46
72.145.35.99
52.110.12.5
52.110.12.25

File paths

U:\@
v:\30
h:\%L

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report