MALICIOUS — ea95ac8764340db5f258fe5d5f0317146f3e42a0545a56113fe40ad506e787ff

MALICIOUS — ea95ac8764340db5f258fe5d5f0317146f3e42a0545a56113fe40ad506e787ff is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ea95ac8764340db5f258fe5d5f0317146f3e42a0545a56113fe40ad506e787ff
SHA-1: 018c7ec2340ef18b946d195941fb16625271cf4d
MD5: f93881a0a9faf153a82089907a831017
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFHcAj8UWJo/LBxLDrz1ncdSmMkQNTyGc:O+K88uPCHlqGLnLDreKNTyGc
TLSH: T1B25A23C55A199B4EE3F2D0517815226E8482F4DA8B3D09CE128FF12D73DB937687209B
Submitted as: ea95ac8764340db5f258fe5d5f0317146f3e42a0545a56113fe40ad506e787ff
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12925 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\1642.tmp - 7e39d7a3346ce9f29f4722d2ed5401a941b638449c1ff4e5186e60b0c113a7c7
c:\users\analyst\appdata\local\temp\tsk_53887c328396449e.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
18cee4bb50cc7dcc87aeac4b50157f05ffd8c77a5c1e2a260363e9d829010941 - 18cee4bb50cc7dcc87aeac4b50157f05ffd8c77a5c1e2a260363e9d829010941

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

lv.tk
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.79.167.9
40.84.97.4
4.230.171.124
20.165.94.54
20.184.175.7
74.178.76.128
104.46.162.231
52.253.84.76
20.42.73.26
13.69.109.130
92.223.78.30
52.110.12.8
52.110.12.21
20.42.179.204
135.234.160.245
135.233.45.221
57.150.192.97
135.234.160.246
52.148.114.188
52.110.12.32
52.110.12.33
72.145.35.98

File paths

k:\#d

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report