MALICIOUS — c5da710784a97e8fb7575a01b0c018794aa8f974f036e45271116ffbfd0bb18e

MALICIOUS — c5da710784a97e8fb7575a01b0c018794aa8f974f036e45271116ffbfd0bb18e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c5da710784a97e8fb7575a01b0c018794aa8f974f036e45271116ffbfd0bb18e
SHA-1: 2233740f56c035383e29b83fd741e1d70cbec614
MD5: e711465ba7fe68ea5292e8eea06e64d4
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d2X72LLL32AMJI7NG5CuJ8NvNgr+zAb:Qoa1taC00Lf2AoO+Cu+gr+a
TLSH: T1775A23561A19560CF6F2C5442C69266DC4419CE3937C268B42CFF14FB3EBA27B82219F
Submitted as: c5da710784a97e8fb7575a01b0c018794aa8f974f036e45271116ffbfd0bb18e
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\17F7.tmp - eb9bfc62350fa09152c300ec7306f09502cb06fabf4da99d653bbfde20918f86
da0ca4984fb77e237e6b8ebaa51664ee2f037ec524ae0916b05914c81d3f8755 - da0ca4984fb77e237e6b8ebaa51664ee2f037ec524ae0916b05914c81d3f8755

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787823086&P2=404&P3=2&P4=YbAQgo6Fo2Lf8FuX1FmJbsESBUk2LtKv8sruAPmH0rr6LsHqV3se3eHC7OvGwX4vqNMA3pwat%2bsnfI6A7x%2f7Xg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787823131&P2=404&P3=2&P4=Qi0fQKKjvEW%2fphr%2bZVNSBuQrOBs1MOuEOcIcZwvA2rSuJYX%2fxP4grRJiUZWyQmgOvrYdIHgoWkoD%2fLomsBvHVA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.72.131
52.123.252.222
20.42.179.192
4.230.171.124
20.247.184.197
20.165.94.63
20.165.94.54
20.42.73.24
20.236.44.162
52.123.129.14
13.89.179.12
135.233.45.223
52.123.252.231
203.26.79.13
52.148.114.188
135.232.92.34
20.42.179.204
74.179.71.159
72.153.5.132
52.110.12.10
52.110.12.30

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report