MALICIOUS — e1de4b14d1c7aa2545919b3a6c7f77ab3aaf5ca5d5d46e0b013ad058b32286d4

MALICIOUS — e1de4b14d1c7aa2545919b3a6c7f77ab3aaf5ca5d5d46e0b013ad058b32286d4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e1de4b14d1c7aa2545919b3a6c7f77ab3aaf5ca5d5d46e0b013ad058b32286d4
SHA-1: 18be826bcb44fed402050607dc9d6505cd084aa0
MD5: 7c6594626e77fb06a29c0822c19ee8f1
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFL92WWKTme+Q3RDz5Sz/zgLo5Ug4CjFfyGc:O+K88uPCHt9HWKTV+MRDsbELaUgdjFfy
TLSH: T1385A23815A2A9B09E3F2D950241A37BDC582E4E6D7BC484A424FF02D73D796B74320DB
Submitted as: e1de4b14d1c7aa2545919b3a6c7f77ab3aaf5ca5d5d46e0b013ad058b32286d4
File type: pe · Size: 2089472 bytes
Verdict: malicious (98/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): D443.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\D443.tmp - d379acad3256d6d53184d876622a5ff0626bb476b91027057239cfd72badcbb1
29454d4b434ec45b49884ee56888cdc719108159aa1d757b7de04df628ec62bb - 29454d4b434ec45b49884ee56888cdc719108159aa1d757b7de04df628ec62bb

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

13.69.116.104
52.230.59.222
4.230.171.124
172.215.188.225
74.178.76.128
52.182.143.212
74.178.76.54
40.99.133.242
135.233.45.221
20.42.65.94
203.26.79.13
52.148.114.188
20.184.175.23
20.76.201.171
40.103.64.242
52.123.128.14
4.247.188.233
20.184.175.11
13.89.179.15
72.153.5.60
52.110.12.50
74.179.71.159
52.110.12.1

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report