MALICIOUS — d779402db15870b5ab562d4741a061f4008b36f4a44a4f5233b4cd578561d89b

MALICIOUS — d779402db15870b5ab562d4741a061f4008b36f4a44a4f5233b4cd578561d89b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d779402db15870b5ab562d4741a061f4008b36f4a44a4f5233b4cd578561d89b
SHA-1: cca0602282e4c5966551f25aa116f575bc8e3533
MD5: 98b8751bf04fe3d033561131bfc28ebc
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFCdUOXossumHIVmlaxNpBpi8pnqGcCuXyGc:O+K88uPCH4dUOXn7moJri8pqGczXyGc
TLSH: T13A5A23CA5A1A5709E7F2C480285976BF8081F4D68778088A938FF11E73E793B747119B
Submitted as: d779402db15870b5ab562d4741a061f4008b36f4a44a4f5233b4cd578561d89b
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12940 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_66445bb5661a4450.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\DE2B.tmp - 52c00b1116ba0e829e8fcc791ba004ca09307375910a36dc10d0de241c652f40
edc76373aa1a7bce7378a8acf2975a85dac43731a091be7aa0db1b09f1cca4c6 - edc76373aa1a7bce7378a8acf2975a85dac43731a091be7aa0db1b09f1cca4c6

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

w.in
a.no
e.gg
c.ws
7.cf
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.11.192.49
40.84.97.4
52.123.252.219
52.230.59.222
4.230.171.124
52.110.12.8
52.110.12.40
172.178.240.161
57.155.101.212
20.42.179.192
104.208.16.94
72.145.35.96
20.42.65.84
52.148.114.188
52.110.12.31
52.110.12.24

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report