MALICIOUS — 8defd5700026958a2d9d30040eef0f424c3734330125cdd02ac82e44d6f9b816

MALICIOUS — 8defd5700026958a2d9d30040eef0f424c3734330125cdd02ac82e44d6f9b816 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8defd5700026958a2d9d30040eef0f424c3734330125cdd02ac82e44d6f9b816
SHA-1: 9c9af28ce7fd83906a3f24714d69c1d52340e2ff
MD5: 5cf298a601c0e8c55823c3ce815a49cd
imphash: c9b6c3da312e87a7377bab0dcbaf2d4a
ssdeep: 24576:SypW9SgLNZaOdcTMuUvxIgDXeer4JPZbiLbO8h0s48rqV3PvLuV59VOD:St9SgLNZa6xIukq7asjDVMD
TLSH: T1A45423E9476249C9C8970B0D535F061C92A77CBBDC9DDC1F2295F2633485883B6E888B
Submitted as: 8defd5700026958a2d9d30040eef0f424c3734330125cdd02ac82e44d6f9b816
File type: pe · Size: 1108132 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Malware.Zusy-9781883-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Salgorea.VRR!MTB
Kaspersky (KVRT): Backdoor.Win32.Salgorea.id

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9781883-0 (rule Win.Malware.Zusy-9781883-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): C97A.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 14 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

157 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\C97A.tmp - 18ee83414dbf26bcddf29dce8933a4a9d7ce3663ac3fe5580c4e26c2a8c2e03e
cdab9660cf25db7302b108a6c280b4af5d8f8d9271b48d554c3e76f34b7a51f2 - cdab9660cf25db7302b108a6c280b4af5d8f8d9271b48d554c3e76f34b7a51f2
2c9aa94b58be5d80a1daa27361bf41122059f7a7db4531cb46d04db18f2eb45f - 2c9aa94b58be5d80a1daa27361bf41122059f7a7db4531cb46d04db18f2eb45f
6d5688e8c2bc105ab282adf14dda5805c892867d9424bff40902386d98d8e0e2 - 6d5688e8c2bc105ab282adf14dda5805c892867d9424bff40902386d98d8e0e2
6d38ad6d8591af4669598200862f418a413b73dff897ba7ab1a41a3e5fd4734e - 6d38ad6d8591af4669598200862f418a413b73dff897ba7ab1a41a3e5fd4734e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.85
20.247.184.142
172.66.2.5
40.84.97.4
135.232.92.137
4.247.188.224
13.69.239.69
20.112.250.133
172.178.240.161
20.42.179.192
20.42.73.26
162.159.142.9
20.231.239.246
52.110.12.46

File paths

U:\cM
L:\~q

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report