MALICIOUS — dbcf9c0ce8b358dcf70cec78f36aa98955f57ba6e53e8cd464f1b393e517dd94

MALICIOUS — dbcf9c0ce8b358dcf70cec78f36aa98955f57ba6e53e8cd464f1b393e517dd94 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: dbcf9c0ce8b358dcf70cec78f36aa98955f57ba6e53e8cd464f1b393e517dd94
SHA-1: f919546f327da0b99733827a9099a222633abffc
MD5: e9948a7ded8e48354c400123de3352e7
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d8WrRpAPVCmroAsKH6IdBNz5Zg63cYolreJ+j:Qoa1taC070dNSlsKH6mR0wS9jEhq/D
TLSH: T1DA5A228A46097B0CE2F6C5802C2A62AD9442A4FB9778158FC1CFF14DB7DB927781119F
Submitted as: dbcf9c0ce8b358dcf70cec78f36aa98955f57ba6e53e8cd464f1b393e517dd94
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3A0.tmp - 61462aac7de642a5d08b1718b09649174cfb239c6fa365ab618ec900934beba7
db0f7e839acb6aa43214a841a132c7c0c9554c55b8b7015348ea454107cdf727 - db0f7e839acb6aa43214a841a132c7c0c9554c55b8b7015348ea454107cdf727

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784381&P2=404&P3=2&P4=Wbvu366%2f8o8ha5aDRMvAnX2OB4E3yHJfKtVCPjEIzBErNCIJHP4FUxES4aaCisf%2fquQoMb3rSaabMpwNaJq8Fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787784454&P2=404&P3=2&P4=ThxA9RmlME1pEfB64Dw7BDW4KPgKMV8Qdb2bFwEH9yeVFWcmt8GoK87uIZD%2bKYU%2bc8ikD9AarKVcbUsZiAEs8A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.9
4.247.188.224
4.230.171.124
52.253.84.76
20.165.94.63
20.165.94.54
20.42.72.131
52.123.128.14
20.76.201.171
52.123.129.14
135.234.160.246
203.26.79.13
52.110.12.4
135.233.95.80
52.110.12.45
85.210.193.152
52.148.114.188
52.123.252.225
142.250.195.131
92.223.78.30
74.178.232.29
72.153.5.141
162.159.142.9
52.110.12.53

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report