MALICIOUS — c581da6704e5b8a412c0ec66a3abc8ce8817989c7a39f4f347d40ef1e972bad0

MALICIOUS — c581da6704e5b8a412c0ec66a3abc8ce8817989c7a39f4f347d40ef1e972bad0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c581da6704e5b8a412c0ec66a3abc8ce8817989c7a39f4f347d40ef1e972bad0
SHA-1: d037aee470614e78ba612388965a92dccd2dc5f6
MD5: b5b34319316c33f5c19e24b502187f3e
imphash: 858aee865f44703f181e0ac78825594b
ssdeep: 24576:8Y4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG97:R3XZynV4oDabuWbDQOcIxJJ97
TLSH: T16E51230B31524BEBE768A33E0E5F6D6E6C1EC6391851A5CD6A27FA433DD20470213674
Submitted as: c581da6704e5b8a412c0ec66a3abc8ce8817989c7a39f4f347d40ef1e972bad0
File type: pe · Size: 835591 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:b5u87
ClamAV (daily): Win.Malware.Fragtor-9909039-0
Microsoft Defender: Trojan:Win32/Zusy.EM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Zusy.465014
Kaspersky (KVRT): HEUR:Packed.Win32.Vemply.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Fragtor-9909039-0 (rule Win.Malware.Fragtor-9909039-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Zusy.EM!MTB (rule Trojan:Win32/Zusy.EM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.465014 (rule Gen:Variant.Zusy.465014) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Packed.Win32.Vemply.gen (rule HEUR:Packed.Win32.Vemply.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:b5u87 (rule high-entropy-sections:b5u87) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:b5u87 - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5832) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

140 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\1A0D0B0E120D156C155A15A0B0B160E0A160F.exe - efb322a214c8f0ac16aac575eec22eed45bc3b9e46c651b2658da4bfb79b062b
b4c070872cf07498db44b7d03555265b67159213a9316df7d73cc02bad2dff6e - b4c070872cf07498db44b7d03555265b67159213a9316df7d73cc02bad2dff6e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.42.73.30
52.123.252.212
4.230.171.124
85.210.193.152
20.247.184.142
48.211.4.16
20.165.94.54
74.179.77.204
20.42.65.93
52.110.12.15
52.110.12.19

File paths

t:\c

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report