MALICIOUS — 9d16d0ea3f592f9e0306399efe56e78745118a09b2d663a225934c2691298097

MALICIOUS — 9d16d0ea3f592f9e0306399efe56e78745118a09b2d663a225934c2691298097 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9d16d0ea3f592f9e0306399efe56e78745118a09b2d663a225934c2691298097
SHA-1: 66c4050b6f5f6278b68bb85982630638786f1fcc
MD5: 34d96f003f07e2eb7ba16c85570066e2
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFCVIiZ59ZaLpIPUFqtDoL1wZznFyGc:O+K88uPCHwVZnZaVIPI+DoAzFyGc
TLSH: T1A55A23D9A6299B4DE2F2D9802C15267E8482F4D693BC188A538FF02D73DB4777032197
Submitted as: 9d16d0ea3f592f9e0306399efe56e78745118a09b2d663a225934c2691298097
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8465 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\4476.tmp - d6a614ba84c14455c63bab3ac8b16d57410167e9163169ee4bb28f804f01597d
c:\users\analyst\appdata\local\temp\tsk_b614519de39f439f.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
7417d23121fd698d897dc597061b6c656fa6824bf702ba0c44bf0d3d30a135e7 - 7417d23121fd698d897dc597061b6c656fa6824bf702ba0c44bf0d3d30a135e7

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x.pw
a.cf
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.89
52.123.252.218
4.230.171.124
4.247.188.233
57.154.63.210
52.230.59.222
74.178.240.51
4.150.223.102
74.179.77.204
104.18.33.89
4.150.223.113
4.207.44.74
52.110.12.16
52.110.12.25
57.155.101.212
72.145.35.106
52.148.114.188
52.110.12.26
52.110.12.4

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report