MALICIOUS — c5f3e6a7dd8a423ca2c6735d11f3524603adfe3e09cc192e5854bdc6ac125d67

MALICIOUS — c5f3e6a7dd8a423ca2c6735d11f3524603adfe3e09cc192e5854bdc6ac125d67 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c5f3e6a7dd8a423ca2c6735d11f3524603adfe3e09cc192e5854bdc6ac125d67
SHA-1: baaa9bd897c81f8134fd645e38808b92c02be3b7
MD5: 25b4741ae8752d5876a3f793fde58ad7
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dSljfDpRne4WFqc2VnlpLJX6V:Qoa1taC0BnTne4WFz2JXJO
TLSH: T1CB5A23C556197B08E7F6C4406C68256EC402E4A7A37814CE41CFF19E77DB9AB78220EB
Submitted as: c5f3e6a7dd8a423ca2c6735d11f3524603adfe3e09cc192e5854bdc6ac125d67
File type: pe · Size: 1958408 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ic

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\FEEC.tmp - a54296e053e285cbab3c1b081aa1a7f16050abde4bd7fccc7821d3535cf7524b
91ca761f9d6d7e29bfe97313f8f22ba9ebaecee50725f247a93b96f67b31d88b - 91ca761f9d6d7e29bfe97313f8f22ba9ebaecee50725f247a93b96f67b31d88b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787881904&P2=404&P3=2&P4=dL6TyZUUdtEUufv6ntnDcfWjaIFDqXPyIRisq8lbgrx17NKre0rnIt1AoRZJVBRSPWgEyj0IZ07LHR2IyNSWIw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787881939&P2=404&P3=2&P4=i1%2fDgmY77csI3BsByiJjGfiTbZM2KR8dEX5r%2fC4B1S4ykMKZfEs%2fM5pLpRj12NCxIb11JCxiUwn34XWTqmnoXg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

j.in
u.ml
0.sh
schemas.microsoft.com

Embedded IP addresses

52.168.112.66
20.42.179.204
4.230.171.124
52.230.60.54
135.232.92.137
20.184.175.17
74.178.76.54
52.182.143.212
52.123.129.14
20.112.250.133
52.123.128.14
172.178.240.163
135.233.95.80
52.178.17.3
203.26.79.13
52.148.114.188
57.154.63.210
48.200.63.27
52.110.12.3
72.154.7.105
52.110.12.50

File paths

X:\QQ

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report