MALICIOUS — a294660214672ae4eef5e6bf49fed7bac2111bf8425f074355f4c99458ae586c

MALICIOUS — a294660214672ae4eef5e6bf49fed7bac2111bf8425f074355f4c99458ae586c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a294660214672ae4eef5e6bf49fed7bac2111bf8425f074355f4c99458ae586c
SHA-1: 3563469bd0bb49c3c64f0716e2beeea0a9579134
MD5: 32cac2a30ad998100a6078d283fd7a60
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFJEN/sxpZXAZ+p5MqDIvXsh4j8lQkmyGc:O+K88uPCH7EN/2pZXAZcMZXsh4j8lQBy
TLSH: T1905A23C56A198B09E6F2C590381D666EC042F9C2977C19CB828FF01DB3DB577607226B
Submitted as: a294660214672ae4eef5e6bf49fed7bac2111bf8425f074355f4c99458ae586c
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12882 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E7C0.tmp - 5ee27b01f9f4ad29eedf6a4b33170195e1976c31d19b83c72c92dc79fc053673
c:\users\analyst\appdata\local\temp\tsk_5e12c4fa4425462c.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
ff39604e9c4731024ad7bf4475ac437e64c60cca93477008c659b3a1cdc83ffa - ff39604e9c4731024ad7bf4475ac437e64c60cca93477008c659b3a1cdc83ffa

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

cu.nl
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.98
4.144.132.114
52.123.252.203
4.230.171.124
74.179.77.164
135.233.95.144
40.84.85.40
20.42.65.84
52.230.59.222
52.168.112.67
4.247.188.233
20.50.73.15
20.42.73.30
135.233.45.223
72.153.5.135
52.148.114.188
52.110.12.19
52.110.12.26

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report