MALICIOUS — dd2460f5f90f88e5499109953a576ce742a658ae0c95c3ad1ace82bc217bbf8f

MALICIOUS — dd2460f5f90f88e5499109953a576ce742a658ae0c95c3ad1ace82bc217bbf8f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: dd2460f5f90f88e5499109953a576ce742a658ae0c95c3ad1ace82bc217bbf8f
SHA-1: ac26c9a53c6bec767cedc09d99e8d26cb92e2762
MD5: 93dabdc7d999d612828f267896f1e213
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dnP/50sg5TrvhitUlUlg5K01FvdTSR:Qoa1taC0wP/qsg5Trvh+Xg5K01FvtSR
TLSH: T1DE5A239A5A056B0DF2F6C5842C29122FD002A4E6977825CB92CFF16E73CB93778111E7
Submitted as: dd2460f5f90f88e5499109953a576ce742a658ae0c95c3ad1ace82bc217bbf8f
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\9977.tmp - d1ee5563af1f32becbdef0e9955835060fe78db12ea75c1cbffbd09d6a0bdf6b
aa8961568f91447b56834f2148d76f73ed7f4712feefd6a01d579d93c5507e00 - aa8961568f91447b56834f2148d76f73ed7f4712feefd6a01d579d93c5507e00

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787784343&P2=404&P3=2&P4=I2M06x9J9pXibyge9iQtOPeFMJ0o7izYeshPbBp%2fj3cuTDpMERtss3ybo4lu%2fqiquZrnJczXXi7czcD0qVblww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787784361&P2=404&P3=2&P4=aif8LdLObIlL4WM9%2fFjU4zJ723UX3qtC1oPF8WVB4Jxvwas7tUClGMORoL8nyhc8Mu43mWeNgpyFQu3gNa%2bIQw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.184.175.18
4.247.188.224
4.230.171.124
52.253.84.76
20.165.94.63
20.165.94.54
20.42.72.131
20.231.239.246
40.104.4.2
52.123.129.14
52.123.128.14
203.26.79.13
135.233.95.80
135.234.160.246
52.110.12.45
40.79.150.121
52.110.12.33
57.154.63.210
52.148.114.188
92.223.78.30
72.153.5.132
135.233.45.223
172.170.180.133
52.168.112.66
52.110.12.25

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report