MALICIOUS — ca004b4479a7153e584a307e368263f57c6683421eee5c0eadef7c3f50c918a7

MALICIOUS — ca004b4479a7153e584a307e368263f57c6683421eee5c0eadef7c3f50c918a7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: ca004b4479a7153e584a307e368263f57c6683421eee5c0eadef7c3f50c918a7
SHA-1: fe3d06511c2555248332e21f8c2c2f0504040ba0
MD5: 82f81acfb18cf84359ec82d2d68f54da
imphash: 46662bf2cbcb79c1bfce5ca1aadf0095
ssdeep: 24576:nyMfP88g3v/xyzHQCFZYyOf30pCqV+DgG2OEcJ35WL91LXJ:d83xyLpFeD304qVqgfPcJJA9
TLSH: T1FC54128D42297640E6B7CB241C146F0E9077B0DE61BE284D0B83C65F36F799BFAA4149
Submitted as: ca004b4479a7153e584a307e368263f57c6683421eee5c0eadef7c3f50c918a7
File type: pe · Size: 1176064 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.XXMM-6736056-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Zusy.GGL!MTB
Emsisoft (Emergency Kit): Gen:Variant.Zusy.406937
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

T1055

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.XXMM-6736056-0 (rule Win.Trojan.XXMM-6736056-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Zusy.GGL!MTB (rule Trojan:Win32/Zusy.GGL!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.406937 (rule Gen:Variant.Zusy.406937) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5876) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

14 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

y5.cc

Embedded IP addresses

52.168.117.175
4.144.132.114
4.230.171.124
74.178.76.54
40.84.97.4
4.150.223.107
20.165.94.63
20.184.175.23
52.110.12.30
52.110.12.19
172.215.188.225

File paths

C:\Users\Katy\Desktop\project\proesshollowing_exe\Process-Hollowing+antidebugger
C:\Users\123\Documents\Visual
z:\ta6F
C:\a5pN
N:\:j:x:
Z:\;j;
T:\:d:l:t:
P:\:h:t:

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report