MALICIOUS — c5310d97a8e83eb091ce6f1e9ef6eab83e984786c2ebacf170c21ce03f5de6c6

MALICIOUS — c5310d97a8e83eb091ce6f1e9ef6eab83e984786c2ebacf170c21ce03f5de6c6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c5310d97a8e83eb091ce6f1e9ef6eab83e984786c2ebacf170c21ce03f5de6c6
SHA-1: 6d2c79f163cc11767bc16071dd4ece22775b6f6a
MD5: 873f5634bc1ea65c12e6dab0452cdb18
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFBjeeOfBcsKBCmuwZnyGc:O+K88uPCHSeOfvECrwZnyGc
TLSH: T1005A23C666191B4DE7F2D0802819326EC542F4D2567C2A8E538FF12E73DB877683219B
Submitted as: c5310d97a8e83eb091ce6f1e9ef6eab83e984786c2ebacf170c21ce03f5de6c6
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12962 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_5ee70555fc43414c.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\1911.tmp - b7b9e276f96284fe764c296c77423bbf88cf876bfe0461c39f4d438bd069da96
53c0522d2267ad3fb1df1e49b39db33171f17121d0e66c7b5556643c11b0e784 - 53c0522d2267ad3fb1df1e49b39db33171f17121d0e66c7b5556643c11b0e784

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

d7.no
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

20.184.175.0
4.230.171.124
85.210.193.152
52.253.84.76
135.232.92.97
52.168.117.174
135.232.92.137
52.168.117.175
104.18.33.89
52.110.12.14
52.110.12.53
172.178.240.162
20.209.154.161
135.233.45.221
52.148.114.188
20.184.175.18
40.84.97.4
4.150.223.108
52.123.252.218
172.172.255.216
57.155.101.212
72.145.35.98
52.110.12.15

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report