MALICIOUS — aca2f5818e393b5297d23a39b62c9915eab06ce2c0bdd3ea4396c2f7e0a65243

MALICIOUS — aca2f5818e393b5297d23a39b62c9915eab06ce2c0bdd3ea4396c2f7e0a65243 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: aca2f5818e393b5297d23a39b62c9915eab06ce2c0bdd3ea4396c2f7e0a65243
SHA-1: 9a894cff1028e92e763cc10446c61408ae6f087c
MD5: a528125103ec17363e6d82587ef362bf
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d/tewD400vT7DlU1//+mA1OBH:Qoa1taC0OtF0dlcGr1s
TLSH: T1D45A23865609770DE6F6C9802C19127EC441A4E7973C1D8E52CFF19EB3DBA6B28011EB
Submitted as: aca2f5818e393b5297d23a39b62c9915eab06ce2c0bdd3ea4396c2f7e0a65243
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\8FF.tmp - 4dfb13e2a7fe6c26af682b50b0097ca5e67d6d045d721a345e9d01c7a7b4c809
3b62426d9fc3da987f5e5cc53cdaca611700f91654bdef3fea33f628f4262e6e - 3b62426d9fc3da987f5e5cc53cdaca611700f91654bdef3fea33f628f4262e6e

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787456265&P2=404&P3=2&P4=MYab1HkJ2mdldoy29sARjUs5QhvrXaFSvPFGrLLeWQC%2flX0vy8ueZOMPVtfEIqzftzg2Ig9XmhaV8Itr63Mnhw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787456336&P2=404&P3=2&P4=A2Sw0pb4we9VTtSuqAG8qSKmCoC3K5H1oBsO%2b2qwKPGlOcjiYFkl6ED0hR0kCccuDaCd7ormlL31w6r1ddAhfA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.174
52.123.252.192
4.144.132.114
57.155.101.212
4.230.171.124
74.178.240.61
135.233.95.135
51.104.15.252
4.150.223.114
52.123.252.222
172.178.240.162
104.208.16.94
52.123.252.232
20.231.239.246
40.103.64.242
52.123.129.14
203.26.79.13
20.165.94.46
52.148.114.188
52.110.12.30
52.110.12.55
172.217.25.163
72.153.5.141
52.110.12.32
52.110.12.49

File paths

H:\`

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report