MALICIOUS — 9541.tmp

MALICIOUS — 9541.tmp is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Zusy family. 4 of 55 detection engines flagged it.

Identification

SHA-256: b081868b6e9af98bbc9b2d53ab2c472b24c2e31299b86cc0e008e6f443365cd6
SHA-1: e8c0fdac3c9fde543ae3562bd019cb0c202236d0
MD5: 6f8e5bb7eb870ae1d0e59672b54931ed
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070diaL70AwouaSLwtDqWtL+uCG:Qoa1taC0w7IoxqwtLQuB
TLSH: T1B75A23865A257B4CD3F6C5807D59256EC442A4E7633C298B028FF04EB3DB96B38112DB
Submitted as: 9541.tmp
File type: pe · Size: 1958400 bytes
Verdict: malicious (90/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

Why this verdict

The malicious score of 90/100 is the fusion of 2 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Contacted 24 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

8 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787661654&P2=404&P3=2&P4=bA9L1hvIceineX8OiMGJJYYDBWdJMBACmWz09KrAKJ14BJQHwUa09igoLjk0D2FuaIpw9N5DFG7OnOfTQZNgAQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787661687&P2=404&P3=2&P4=iyvsbuhN66o%2fr8gIDrRRkHCEbJ5pNoGlYeLfVVhUbHM5%2bnhiIyjirg0U91KvMBJ9%2fJy6Pld9%2b3w26YeUO7fs6g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787058453&P2=404&P3=2&P4=kqcg25IdOIgYXAbL6nESa3nzEAC6xe8BiLELTjO%2bxjuFnvqmmUmOwQ2qJUoo9qIig6vwChU5j70%2bFK70KIxe5g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787058013&P2=404&P3=2&P4=aWvo%2by17pb78JmORxj6reSqH8ddzv0elosVK51DDnK0DsSJcu6ocmlVb3aApOCddYH%2bmN1aLQKIw%2bU9rrFkMUg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

4.150.223.109
20.247.184.142
4.230.171.124
57.155.104.224
74.178.76.128
135.233.95.135
203.26.79.13
20.42.65.84
20.76.201.171
52.123.129.14
52.123.128.14
74.179.71.159
135.233.45.223
52.123.252.212
172.217.25.163
52.148.114.188
72.153.5.134
135.234.160.245
52.168.117.175
48.200.63.27
142.250.195.99
74.178.232.29
52.110.12.5
52.110.12.18

File paths

M:\$V

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report