MALICIOUS — fa4884dcb29a34112e9c02d7be490d41b2e43e14847822074ae0992c524588f8

MALICIOUS — fa4884dcb29a34112e9c02d7be490d41b2e43e14847822074ae0992c524588f8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fa4884dcb29a34112e9c02d7be490d41b2e43e14847822074ae0992c524588f8
SHA-1: 41a6a3fb5c36a61cc05cdad14dd9ba65457562f2
MD5: e17da54371f8ce1c40f7eb5dce79172d
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d0nMbXDIPqgukJaA7EqCF4qS7dhDu+A3k:Qoa1taC0tM/YJue7tCf8j
TLSH: T1F35A2341569A6B0DE2F5C4846D39153EC482E4FAE338258B838FF05EB3DB96B3461187
Submitted as: fa4884dcb29a34112e9c02d7be490d41b2e43e14847822074ae0992c524588f8
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E91E.tmp - 7d1af39980682984cb4484883819e12d76915d4a575de87373d2c70402c1e4cd
9c848ae77455f0f74408365a50b2c8130fe03af291ea81eac9ff39497b6f9f5c - 9c848ae77455f0f74408365a50b2c8130fe03af291ea81eac9ff39497b6f9f5c

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787771086&P2=404&P3=2&P4=HV5jMqxAHsjvPSQkIOdDJ8o5F1d1qFxjVmHbhifKd2sRH33OLMGNo48NNIuM1B0kNK2RskpCN4JoRuqe63%2btGw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787771134&P2=404&P3=2&P4=IYJS93NaLdLUmtkknP3awQ2YdLJ6ZrKMP%2bvZM3bC5JvlvORNHJYcl28Wj0zycT%2frvNvLrC7EtyElaS7viOn9zQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

schemas.microsoft.com

Embedded IP addresses

40.79.150.123
52.123.252.232
20.42.179.192
4.230.171.124
52.253.84.76
74.178.76.128
52.182.143.212
20.165.94.54
52.123.129.14
20.76.201.171
52.123.128.14
20.42.65.89
203.26.79.13
172.178.240.162
172.66.2.5
52.123.252.231
135.232.92.34
57.155.104.224
52.148.114.188
20.184.175.17
52.168.117.169
72.145.35.101
135.234.160.244
142.250.207.3
92.223.78.30

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report