MALICIOUS — d4a0d50f71fdf38e0fe3e5c871eeba2697bc823391cb52c504b6eec1c58cd0e8

MALICIOUS — d4a0d50f71fdf38e0fe3e5c871eeba2697bc823391cb52c504b6eec1c58cd0e8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d4a0d50f71fdf38e0fe3e5c871eeba2697bc823391cb52c504b6eec1c58cd0e8
SHA-1: 8e7e5235a9e767d1b9c4e3a9e20a23feb70a25e8
MD5: 03000a20adaf286f4ad7330b48955993
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFQzQOIBCy5Dhioy2X9oB3T6p5PfyGc:O+K88uPCHcwCODhioR9oB3kHyGc
TLSH: T1115A22C58D1A9B08E7F5D150282A666E8042F9D2973C08CF828FF02E77DB9776871197
Submitted as: d4a0d50f71fdf38e0fe3e5c871eeba2697bc823391cb52c504b6eec1c58cd0e8
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12903 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_bbc25e3840a44a7e.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\F675.tmp - 139db91fe71994fcab08d707f4a96dc8c51c5b857579de7b8ec5616ecf7a7c47
15a5bef439817d9180f2196b09f4c4961872b37222ef96a1b522997dbd1c097d - 15a5bef439817d9180f2196b09f4c4961872b37222ef96a1b522997dbd1c097d

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.174
40.84.85.40
52.123.252.218
4.144.132.114
57.155.101.212
4.230.171.124
74.178.240.51
74.178.76.128
20.50.201.201
20.42.73.31
172.64.154.167
135.232.92.137
52.110.12.50
52.110.12.15
4.247.188.224
20.42.73.30
20.42.65.91
135.234.160.245
72.145.35.108
52.148.114.188
52.110.12.55

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report