MALICIOUS — b166d1bb8c53b8d69bd65408cbd0358d929a21c8e9dec673b10b3b591e3937cb

MALICIOUS — b166d1bb8c53b8d69bd65408cbd0358d929a21c8e9dec673b10b3b591e3937cb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b166d1bb8c53b8d69bd65408cbd0358d929a21c8e9dec673b10b3b591e3937cb
SHA-1: ab54e710db77cf10fc3aaa4bc770704e9e3ee569
MD5: fb8a03068d32b496024390c36d964efe
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070du9/nmoxj3y7SLMLeELSFwab8bV:Qoa1taC0jOoxj3y7yieELSFwxV
TLSH: T1B65A238956492F0CE3F5C5902D28266EC441D4FA637C198A828FF05EB3D7AAB78111DF
Submitted as: b166d1bb8c53b8d69bd65408cbd0358d929a21c8e9dec673b10b3b591e3937cb
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\EB45.tmp - 82f7ac8cf39907e578c38743b90d908c89b9084236a57b0d4ee2543daa54c380
e2b58f41ae7c7b82ffc808d1ed110c711e07638ad955be871df1bfa8200ccbb0 - e2b58f41ae7c7b82ffc808d1ed110c711e07638ad955be871df1bfa8200ccbb0

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787733592&P2=404&P3=2&P4=UlglTzV1Zd8NvzvlZd3quVMnnuPCXkpJrV1cOBF5te%2bFLcixzZBBkoxOJn9m9hPeMcjgpJhnVKEgAvBR5gwsdw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787733624&P2=404&P3=2&P4=kzI8M5v1f9fE2d2HVyV6nECiCchM8ujMt48MW%2fWollm92OGAlylHKJA0hjezq3FD9vI2u6nfFDkCOxFgxyZUmw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

mf.nl
schemas.microsoft.com

Embedded IP addresses

52.168.117.171
40.84.97.4
4.230.171.124
4.144.132.223
135.232.92.137
74.179.77.164
40.74.98.199
20.76.201.171
40.99.133.226
52.123.129.14
52.123.128.14
40.99.134.18
4.247.188.233
135.233.45.221
52.123.252.218
20.165.94.46
52.123.252.230
203.26.79.13
52.148.114.188
4.150.223.114
20.42.72.131
92.223.78.30
135.233.45.223
172.170.180.133
72.154.7.101

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report