MALICIOUS — 8829852941cb8639a752ce7993d114ca657874757adf45c6f32b3ec5a7237867

MALICIOUS — 8829852941cb8639a752ce7993d114ca657874757adf45c6f32b3ec5a7237867 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8829852941cb8639a752ce7993d114ca657874757adf45c6f32b3ec5a7237867
SHA-1: 1ac0456f05d402f9e27b7c74e5d29a98f5b1ec34
MD5: 02bc2f71d4ab40d9c38379fb5b9f1040
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dfdwQhN4+s+PbAiHM4dm/XyW7LZ6Ru/:Qoa1taC0yA+Po4doXyWWq
TLSH: T1945A23465218770CE2F6C5843D28156EC842D4E7A77C2ACA42CFF0AEB3DE953782159B
Submitted as: 8829852941cb8639a752ce7993d114ca657874757adf45c6f32b3ec5a7237867
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A459.tmp - 72150074627fd3ad8ef48011f7abea27562ce1cd6e2f37205599c9165ed3f687
add2f60dcef0c771d7bbdd6954fb8828a10fc433346bb8e6cff69e03ec768d08 - add2f60dcef0c771d7bbdd6954fb8828a10fc433346bb8e6cff69e03ec768d08

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784044&P2=404&P3=2&P4=O2E5Tl51fyWoA5AnxMqzu%2bgK8ZORXmKudLVvkAIrAW%2fJ7kfFe%2fZ8US7YHie7m%2b61rqAPoZ9%2batBKW8vYpQsq8g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787784120&P2=404&P3=2&P4=LhaUmUH%2fekFbELeG79HKL7PtSRXOpof0UJuirMENrkwOVD%2fQudf7RBXRF9VQvGSu%2bVTZ6i9W9EFSVYQcy0TjAQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
aefd.nelreports.net

Embedded IP addresses

20.50.201.200
52.123.252.233
4.144.132.223
4.230.171.124
20.42.179.192
52.123.252.192
74.178.76.128
52.168.117.168
74.178.76.54
20.231.239.246
52.123.129.14
52.123.128.14
40.99.133.242
20.184.175.19
74.179.71.159
203.26.79.13
135.234.160.245
172.66.2.5
52.110.12.52
52.148.114.188
72.145.35.102
4.247.188.224
92.223.78.30
52.110.12.21
52.110.12.28

File paths

z:\#izk

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report