MALICIOUS — a61fb2d8ca249c407e7c15c1ea34b8d0bee1ab44e272702b7a48135d13b58316

MALICIOUS — a61fb2d8ca249c407e7c15c1ea34b8d0bee1ab44e272702b7a48135d13b58316 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: a61fb2d8ca249c407e7c15c1ea34b8d0bee1ab44e272702b7a48135d13b58316
SHA-1: f066eee17e6b4faba312c4b2154d086d96da4f45
MD5: ec220c0daffdd6e1b2e38d095d7646a1
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d43cJ8cMsHNkLpMhb2hGMZNSryp0CXE3:Qoa1taC0dsxNkOhb09Sa0D
TLSH: T1E75A2396490D670DE2F6D1842C2C156DC841E4F6E33929CA928BF14EE7C79A73C211DB
Submitted as: a61fb2d8ca249c407e7c15c1ea34b8d0bee1ab44e272702b7a48135d13b58316
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

97 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\F5B0.tmp - 7136ef29cfc86f09493c6177956af23d06c9c81fb85705996064852362c655db
ca9dc25fcbd8022e778a0a0cfdc8d25af79c7bb4afd15823ebb7798fd3939197 - ca9dc25fcbd8022e778a0a0cfdc8d25af79c7bb4afd15823ebb7798fd3939197

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782592&P2=404&P3=2&P4=YhYv1ts0gCK1VXL4FZgr5QLM%2fXGSWsdo1%2b4qzLWYk%2bpnte1N%2bM%2b1otd3WeJuFNexZmzFkWRVSo4QeZeoX%2fPuJw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782631&P2=404&P3=2&P4=W1We5Ci1ZE90M6YTmxITaUeSiv8YoSD8kCktPDOl%2bGz1ayMYOwFCErXC%2bwlb8%2bjKfEWkfXmcvN3XE%2bOrzTC%2bnQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

z.de
schemas.microsoft.com

Embedded IP addresses

20.42.179.192
4.150.223.107
4.230.171.124
4.144.132.114
85.210.196.11
74.178.240.61
4.150.223.105
74.179.77.164
52.123.128.14
52.123.129.14
20.236.44.162
20.184.175.2
20.184.175.19
20.50.201.201
172.178.240.161
203.26.79.13
52.123.252.224
52.123.252.225
74.179.71.159
52.148.114.188
57.154.63.210
52.110.12.55
52.110.12.15
72.145.35.99
4.150.223.100

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report