MALICIOUS — 945815408baa39650483c87c10655524eb29cc9c53a3425b1c0ed072ef7dcc58

MALICIOUS — 945815408baa39650483c87c10655524eb29cc9c53a3425b1c0ed072ef7dcc58 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 945815408baa39650483c87c10655524eb29cc9c53a3425b1c0ed072ef7dcc58
SHA-1: 1417d66f384f89513ba0f91b27e1d29bfc0ba786
MD5: 6e8e5597cf59436f6c7122138f0f14c2
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d2eT8BbZ9mRkPRzz18kyxv9:Qoa1taC0G8BVIRkd18/H
TLSH: T1BE5A23865619660CE6F6D4842C59123EC082E4EBA37C248B52CFF15EB3DB95738211EB
Submitted as: 945815408baa39650483c87c10655524eb29cc9c53a3425b1c0ed072ef7dcc58
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\58E8.tmp - b1247c3db00dbf6cfae339215cda55217be5d91335bc570103669777933c7929
fdf8642ff8479a07066bb9ccf2db303f1465a7fccdba4287e52a7a9b4bc8c8c6 - fdf8642ff8479a07066bb9ccf2db303f1465a7fccdba4287e52a7a9b4bc8c8c6

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.170
4.230.171.124
4.247.188.233
74.178.240.51
57.155.104.224
52.168.117.175
74.178.240.61
4.144.132.223
172.64.154.167
52.110.12.44
52.110.12.40
125.56.205.65
125.56.205.26
20.42.65.91
40.84.97.4
72.153.5.133
92.223.78.30
52.148.114.188
52.110.12.20
52.110.12.37

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report