MALICIOUS — mutated_31098.exe

MALICIOUS — mutated_31098.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (74/100), attributed to the Zusy family. 3 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: df7ed0221749244faded8aaf680019c7339aa4fc244a59158d556ab7de8690b0
SHA-1: 05cdb231988763573adfbe72df54fe03b82a98bd
MD5: f8593c644f2a4eb9581af169da4c3eb4
imphash: 542863a264e826bf130b0880664f67e4
ssdeep: 98304:M7GpL4IFkDS1foMqv4Yop7IyoB+QBPDE7uq:M7GpZ31foMqtB+QBPDED
TLSH: T12B6A6C7071656487CFFA1630BCAE456E37B360202AB6D38C1386215391D26FF8A7C5E6
Submitted as: mutated_31098.exe
File type: pe · Size: 9807977 bytes
Verdict: malicious (74/100) · Family: Zusy

Detections (3 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Zusy.KK!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 74/100 is the fusion of 4 weighted signals:

Dropped a suspicious payload (AntiDebug): mutated_1294.exe - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gcc.gnu.org/bugs/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

368 behavior events · 0 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\mutated_1294.exe - 76b92dd7433afbba5db57c329c316b21f47ff18240f51849d33e101ae452bc60
C:\Users\analyst\AppData\Local\Temp\mutated_4408.exe - 130d9006abd04c8073e98d5d2bac93809b6587604a772852a29921d5b705b456
C:\Users\analyst\AppData\Local\Temp\mutated_16653.exe - aa95e5b0d1ad61a9fb1583c0ad6695a175fd214427463c76740792cf36e4a8a2
C:\Users\analyst\AppData\Local\Temp\mutated_10501.exe - 0fd31ec5baeca0fa65dc94fbd4dc976794521d3b6477bcf0e773b61542e48deb
C:\Users\analyst\AppData\Local\Temp\mutated_21758.exe - e0e9c9de3509a0d207a29b82f1b0e822ddfd85f930a7bf68620bf3df929328f9
C:\Users\analyst\AppData\Local\Temp\mutated_4511.exe - 63d816fec5aa2f0318c6e3e8e1787a48d6202ff101c03ccaca133a3426ff8bcd
C:\Users\analyst\AppData\Local\Temp\mutated_25131.exe - dc8679e664c138e1a4b743dfa89b2612206207d9c80394792437aeeee9564ec0
C:\Users\analyst\AppData\Local\Temp\mutated_16352.exe - a6b19fa9ce98235688d1b289a3e5ac44b87eea92fb7c56de0e443aa2d2fcefcc
C:\Users\analyst\AppData\Local\Temp\mutated_16454.exe - 46a7bad4a835e97040a3e208748db6ce03c9a00258291e2a9a55833a17f86ec2
C:\Users\analyst\AppData\Local\Temp\mutated_17656.exe - 61983e80dbd085aec350e5cdac7f5a2b73e6eab6bb25a37ca3d94fea2e7ce6a5

Embedded URLs

https://gcc.gnu.org/bugs/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787648202&P2=404&P3=2&P4=hBxew%2feh6T%2bjOLgp91aJhV52qXC%2fE8Y8xZb1PfzKSJYGTb3L5wYWTFcTYqidawxgd2MvX1%2f%2fIb3aveI7h7yEZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

gcc.gnu.org

Embedded IP addresses

4.207.44.72
4.247.188.233
52.123.252.248
20.247.185.124
57.154.63.210
4.230.171.124
74.178.76.128
135.233.95.135
51.132.193.105
52.123.129.14
20.112.250.133
4.150.223.111
52.123.252.239
172.178.240.162
203.26.79.13
52.110.12.14
52.110.12.54
40.84.85.40
52.148.114.188
172.178.240.161
20.209.154.161
52.123.252.234
74.178.76.44
52.123.252.213
72.154.7.104

File paths

X:\:`:d:h:l:p:t:x:
X:\:h:l:p:

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report