MALICIOUS — d63050e38a58015db3e1407dba3fd50a2f11135e22f852b63217a3385b48ebcf

MALICIOUS — d63050e38a58015db3e1407dba3fd50a2f11135e22f852b63217a3385b48ebcf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d63050e38a58015db3e1407dba3fd50a2f11135e22f852b63217a3385b48ebcf
SHA-1: e71d3c8c3a99ef4cab8e1da99d461402ffbe4ce8
MD5: 2d6b51954caf30861c6f217052fd5f68
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SF4QXhk1ec5eXINNCuAzxe6D3m9fJhR5yGc:O+K88uPCH6cYLCdxeb9fJhR5yGc
TLSH: T17A5A23D61A2A9B09E6F2D550381622BE8141F4D6977C5CCA438FF01E73DB82774321AB
Submitted as: d63050e38a58015db3e1407dba3fd50a2f11135e22f852b63217a3385b48ebcf
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): 48DB.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

101 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\48DB.tmp - 9868a26d96c95ddc04dee14e422e99c8dbdd7594d694ffe354d6a85d7dcdb62a
e4dae448134c9ed14b42ea622aaaab6dc1749d3c009c6004d9c9065655b9647a - e4dae448134c9ed14b42ea622aaaab6dc1749d3c009c6004d9c9065655b9647a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787529777&P2=404&P3=2&P4=dYdo5rttgYX%2bZUq8J0hgM%2fkmxwyG7TkW1EATRapORmALZ8eVGMa1SLYd0PDJJe1kK5Rpv8KDcdVmtKW4azrOjA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787529902&P2=404&P3=2&P4=IZLo4HPW%2bQ4Ogp2tGTWTXIyeo28JsE%2fHga3eT2GuAjW0H%2biq2%2bbIuqlI7Yt9h4%2f26YYKhh8c1EM220%2blYtuzcA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

cw.mx
schemas.microsoft.com

Embedded IP addresses

172.217.25.163
20.184.175.1
20.247.185.124
4.247.188.233
4.230.171.124
20.42.73.28
74.178.76.128
74.178.240.51
74.179.77.204
4.150.223.110
203.26.79.13
135.234.160.244
4.150.223.100
52.148.114.188
20.165.94.46
13.69.116.104
40.104.4.2
52.123.252.238
184.84.165.171
4.150.223.98
4.150.223.105
20.231.239.246
172.66.2.5
52.123.128.14
52.123.129.14

File paths

G:\vX

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report