MALICIOUS — 8a5389d9a5a38f1d27e76939c1c196b8c6c841fbe56c3f822c683b2e4a1e075e

MALICIOUS — 8a5389d9a5a38f1d27e76939c1c196b8c6c841fbe56c3f822c683b2e4a1e075e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 8a5389d9a5a38f1d27e76939c1c196b8c6c841fbe56c3f822c683b2e4a1e075e
SHA-1: 7e5fc03eb857011408565dfd8604ac60438396c0
MD5: 2b6d3cb80128d11ab35849ff65dcf3e8
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d+T9WioIPMd8SXIA/7JYfJXk41tbWhbC84:Qoa1taC0LT9to4jS4B314W
TLSH: T19F5A2349A65A770CF3FAC4446D19166E8402E8EA937814CF818FF09EB7CB5673C1219B
Submitted as: 8a5389d9a5a38f1d27e76939c1c196b8c6c841fbe56c3f822c683b2e4a1e075e
File type: pe · Size: 1958408 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ic (rule Backdoor.Win32.Salgorea.ic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\5520.tmp - d21c3646ab0893cba649940b9a4c800b8b236e6251f29d162830015cf3aed949
5d7bc42ce3391188e05274105ed31007f0d6e6e45167808a146705e0bb550f0a - 5d7bc42ce3391188e05274105ed31007f0d6e6e45167808a146705e0bb550f0a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788109588&P2=404&P3=2&P4=CbldpX2muK32Ubcits2DL91yJ7Z7GUaMpNXnS62aarsl%2bIIjpEUASSKhctIsaBLEIpTVVr1fnXnjVTplfr0uKw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.106
52.123.252.192
4.230.171.124
20.42.179.204
52.230.60.54
135.232.92.97
4.150.223.107
135.232.92.137
4.150.223.109
104.18.33.89
20.42.65.85
162.159.142.9
52.123.252.197
135.233.95.80
52.123.252.224
203.26.79.13
92.223.78.30
52.148.114.188
72.145.35.102
52.110.12.45
52.110.12.46

File paths

j:\V
M:\]

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report