SUSPICIOUS — mutated_12690.exe

SUSPICIOUS — mutated_12690.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100), attributed to the Zusy family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 760d9ab684409ab240592ebc7e182fe184e556b4b7dea7ef47f2d7e9e0be8673
SHA-1: 953206495cd7710c74aefb92c9c1cfebbdc0e2db
MD5: f71ef3a478d3c185b649910631eade9a
imphash: 542863a264e826bf130b0880664f67e4
ssdeep: 98304:Z7GpL4IFkDS1foMqv4Yop7IyoB+QBPDE7ux:Z7GpZ31foMqtB+QBPDES
TLSH: T1246A6C7071656487CFFA1630BCAE456E37B360202AB6D38C1386215391D26FF8A7C5E6
Submitted as: mutated_12690.exe
File type: pe · Size: 9807976 bytes
Verdict: suspicious (64/100) · Family: Zusy

Detections (3 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Zusy.KK!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

MITRE ATT&CK

T1105

Why this verdict

The suspicious score of 64/100 is the fusion of 4 weighted signals:

Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gcc.gnu.org/bugs/ - static signal, weight 0.35, confidence 0.60
Dropped 14 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

519 behavior events · 0 ATT&CK techniques · 14 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\mutated_869.exe - 8d6691d0102464c42e7675ffbc9199efff3d2e62b55950f36cfe489b5fe03445
C:\Users\analyst\AppData\Local\Temp\mutated_5845.exe - 1e1e9602d71bde87afddbe979420bf5eb23940871e2dcdf93bba2b63b73839df
C:\Users\analyst\AppData\Local\Temp\mutated_7523.exe - 824bb3d999d1c1fcdc9c1322dcd00dbfaf6ba6e1a183d8fc5ef8ff677229bd86
C:\Users\analyst\AppData\Local\Temp\mutated_20442.exe - 31485353c112563ceea3ec0f6067cfd7247765eb36221f2a6208d6ac919544d5
C:\Users\analyst\AppData\Local\Temp\mutated_8397.exe - 0ef7cfa2d852bd07696752c9c5b20fe1805f10446a83f44ed2e053f049fdeb4c
C:\Users\analyst\AppData\Local\Temp\mutated_20329.exe - 146f011eb661ed032004a6b75e0bb16dc12845a3ede21dcd84f0fed9da10e97c
C:\Users\analyst\AppData\Local\Temp\mutated_8601.exe - f583942712ea6d266a7081f0c8d76b931b5ded238596f97cf78a543cc63e8a6e
C:\Users\analyst\AppData\Local\Temp\mutated_32284.exe - 078b7aaf0b2654cb423a1045ff0e72244933ccc63503ac97a63b3cdfc0581dd8
C:\Users\analyst\AppData\Local\Temp\mutated_8703.exe - 97e07c11480c2320bfd4304acda8d6dad2c8b0a7ca398971d2209e5bd01316c1
C:\Users\analyst\AppData\Local\Temp\mutated_24430.exe - 4c77a3eb9ece3c0fadbcde9626679c32bd065b5e8305729f1c73b19e3379659c
C:\Users\analyst\AppData\Local\Temp\mutated_32386.exe - d18ea95e206f70192d6f1c35dec2622eb33ff7c4bef8bfff0d151d95bcaf3ac2
C:\Users\analyst\AppData\Local\Temp\mutated_32590.exe - 740da152acdc0608788da28fa6e601376af0defd9da78ddbc2c8836670f48c26
C:\Users\analyst\AppData\Local\Temp\mutated_32088.exe - 134917af83f04e513c4f7151a04f9b3ecdbf2c0c9c9787bd3b7ee45deecb9951
C:\Users\analyst\AppData\Local\Temp\mutated_8526.exe - 70b1befef494ee53344023416d7cfded4c61610b66e2c20749450a5174a53f83

Embedded URLs

https://gcc.gnu.org/bugs/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787645826&P2=404&P3=2&P4=XZtkEJ276o5dW40gkaXkWzxhotFqo7eN5Lb8VG5rYRC02RSh%2fwstjaM5dNa4Ku49HCm0ciGB6pDbEG2FBluXWA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

gcc.gnu.org

Embedded IP addresses

52.110.12.18
40.84.85.40
4.150.223.96
52.123.252.233
52.253.84.76
4.230.171.124
20.42.179.204
74.178.240.61
20.165.94.54
4.207.44.67
40.99.133.226
20.236.44.162
52.123.128.14
52.123.129.14
52.123.252.230
52.123.252.229
203.26.79.13
135.234.160.245
52.148.114.188
135.232.92.34
52.123.252.198
72.153.5.140
52.110.12.20
52.110.12.31

File paths

X:\:`:d:h:l:p:t:x:
X:\:h:l:p:

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report