MALICIOUS — a12854ebe491d2ace6ba9a6ca7ca9c1ee97ebdbea9f14f5ff66ccd4c406f2ef4

MALICIOUS — a12854ebe491d2ace6ba9a6ca7ca9c1ee97ebdbea9f14f5ff66ccd4c406f2ef4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a12854ebe491d2ace6ba9a6ca7ca9c1ee97ebdbea9f14f5ff66ccd4c406f2ef4
SHA-1: 6644e6dd82af0d80d5f79047c3837aeb9f9b5bfe
MD5: 5a0fab65fbfb071c9cf7a5d0455fb8c3
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFwNiE0jleIeW7MbjjistKfIkzWyGc:O+K88uPCHHXekgNsIMWyGc
TLSH: T1205A23829A299B4CD7F1C640381A267E8042F8D566BC498E438FF12E33D7967747219F
Submitted as: a12854ebe491d2ace6ba9a6ca7ca9c1ee97ebdbea9f14f5ff66ccd4c406f2ef4
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2863.tmp - 014059fb55a28c91f98674dadd298adbd0f93f75a80df52c275712f2254101f0
56fbe053d07cbf6612d59ddbb36fdc00ab215fe780328131306f84e5e96e7d59 - 56fbe053d07cbf6612d59ddbb36fdc00ab215fe780328131306f84e5e96e7d59

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787948158&P2=404&P3=2&P4=PUNGMMguusOgCH8VP8NI3J3hbJMVN4Y%2b1Nlq4SNvwrdR6JdSok0ySs07OL6gI%2f5zGM8nFk5kaiflUTSpTGkOEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787948225&P2=404&P3=2&P4=lyeZxe4Z%2fc9KN1R8piuvCCnxIB6Yss%2fPBrTbP4eDLnlUvv%2fbGuK%2bum1%2f374c9z7FAjbLtm%2fmS%2bikgQfrKoTV%2bQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.174
52.123.252.215
4.230.171.124
4.247.188.224
20.247.185.124
135.233.95.144
20.184.175.12
74.178.240.51
20.42.73.26
52.123.129.14
20.112.250.133
52.123.128.14
40.103.64.242
203.26.79.13
135.234.160.244
52.123.252.218
74.178.76.44
52.148.114.188
52.110.12.1
184.84.165.171
184.84.165.136
72.154.7.100
20.89.1.8
92.223.78.30
52.110.12.26

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report