MALICIOUS — 78de41560e418850a02ee472b2adae1b62794b30f881ab3c3bf349ae3c30dba8

MALICIOUS — 78de41560e418850a02ee472b2adae1b62794b30f881ab3c3bf349ae3c30dba8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 78de41560e418850a02ee472b2adae1b62794b30f881ab3c3bf349ae3c30dba8
SHA-1: 1ec7f44bf3a35c2ab6ed6bce8d3d927ddeb3974f
MD5: a1233f11402a1ac5a3301257de34535b
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dWTPXap+hPTApnQY1kP64iJF:Qoa1taC0XTPKGw5CP64ij
TLSH: T14D5A23895649234CE7F5C8843D29127EC441E4E7A37D258F928FF04EB7CBA57282119B
Submitted as: 78de41560e418850a02ee472b2adae1b62794b30f881ab3c3bf349ae3c30dba8
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\313C.tmp - f47c7229495ed66ccc9152eed5f7bca35549237c658fa4a8610a377b7fa8af59
b09ec3978c5b6e88993f9b563a5ba6e882d16717485163dd4e7aad0e19488396 - b09ec3978c5b6e88993f9b563a5ba6e882d16717485163dd4e7aad0e19488396

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787949073&P2=404&P3=2&P4=iTQlUlUwsH0yTvVX7qXT8mpcuwgirqyheFt5VYLgbGXtvJ2IgA2Gp4twAyPwbNLzuUPRC0GedkmU6l%2fj5nsPyQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787949115&P2=404&P3=2&P4=BmJkBH%2fYguzV5WIWU%2fEFe%2fKSGynZp9Agj8fxINhiUctSIOMpicIjTh2vySEHqU1wjYjI3DggAy9KG1Hier93Iw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.73.25
57.155.104.224
4.230.171.124
52.230.60.54
74.178.76.128
20.165.94.54
52.168.112.67
20.236.44.162
52.123.129.14
40.99.134.18
52.123.128.14
52.138.229.67
135.234.160.246
203.26.79.13
52.123.252.204
74.179.71.159
92.223.78.30
162.159.142.9
52.123.252.239
52.148.114.188
184.84.165.136
4.150.223.112
72.145.35.106
52.110.12.49
52.110.12.52

File paths

H:\q

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report