MALICIOUS — f97e1d4cc8feda20f99fcc42688afa1b9f39b1021972ebef8fe53481176378e5

MALICIOUS — f97e1d4cc8feda20f99fcc42688afa1b9f39b1021972ebef8fe53481176378e5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f97e1d4cc8feda20f99fcc42688afa1b9f39b1021972ebef8fe53481176378e5
• SHA-1: 8d22c51075b4afe749c1dbb5853355b975060a73
• MD5: 23378c9004cb7b9ccdc63249a920281c
• imphash: 858aee865f44703f181e0ac78825594b
• ssdeep: 24576:VY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9Q:K3XZynV4oDabuWbDQOcIxJJ9Q
• TLSH: T17F51230B32524BEBE768A73E0E5F6D6E6C5EC6391851A5CD6A27FA433DC20430213674
• Submitted as: f97e1d4cc8feda20f99fcc42688afa1b9f39b1021972ebef8fe53481176378e5
• File type: pe · Size: 835589 bytes
• Verdict: malicious (99/100) · Family: Zusy

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:asYH0
• ClamAV (daily): Win.Malware.Fragtor-9909039-0
• Microsoft Defender: Trojan:Win32/Zusy.EM!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Zusy.465014
• Kaspersky (KVRT): HEUR:Packed.Win32.Vemply.gen

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Malware.Fragtor-9909039-0 (rule Win.Malware.Fragtor-9909039-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Zusy.EM!MTB (rule Trojan:Win32/Zusy.EM!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.465014 (rule Gen:Variant.Zusy.465014) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Packed.Win32.Vemply.gen (rule HEUR:Packed.Win32.Vemply.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:asYH0 (rule high-entropy-sections:asYH0) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:asYH0 - static signal, weight 0.25, confidence 0.55
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Memory forensics: 5 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5880) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

146 behavior events · 0 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• www.msftconnecttest.com/connecttest.txt

Dropped files

• C:\Users\analyst\AppData\Local\Temp\1A0D0F0C120D156D155D15C0D0F160D0F160C.exe - d0315b6c8f6eb83cbe096489731d8e6d6a3744044ed33a261f79b651a81cee26
• e863eea2e553542cf4dc891eba59940b281f06264f8fcb64e52f6f0476ad76cf - e863eea2e553542cf4dc891eba59940b281f06264f8fcb64e52f6f0476ad76cf

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 40.79.167.9
• 4.144.132.114
• 4.230.171.124
• 52.110.12.10
• 184.84.165.136
• 52.110.12.20
• 184.84.165.171

File paths

• t:\c

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report