MALICIOUS — fa4fb4fecd478d493921f01a7eb78d43a8c67d5314408ffd2a9dd50fd95a8d59

MALICIOUS — fa4fb4fecd478d493921f01a7eb78d43a8c67d5314408ffd2a9dd50fd95a8d59 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fa4fb4fecd478d493921f01a7eb78d43a8c67d5314408ffd2a9dd50fd95a8d59
SHA-1: 9db708d511beaf6a6bb331514f86c3a233b530fc
MD5: 729fb317e14395e0729284ed5c3f9d6a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d6A7sm3ZnXHRM6/dZjX5IMnyIfu+B:Qoa1taC0LmJXHN/dZjXlzfj
TLSH: T17E5A2349550D770CE3F2C8847C6A11AE8442E8E657380A8B91CFF05FA7DBA6B78111DB
Submitted as: fa4fb4fecd478d493921f01a7eb78d43a8c67d5314408ffd2a9dd50fd95a8d59
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\9FC5.tmp - 9bf29c8e4f88f57c89042e69dd1b6c66456390cec0954269ed1c39a3b9a89abb
4a288e8786735efcfa79af3f7e58a2f35e2bcd0cec5edd4e896e274f35d82ee3 - 4a288e8786735efcfa79af3f7e58a2f35e2bcd0cec5edd4e896e274f35d82ee3

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

xi.cf
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.89
52.123.252.245
4.230.171.124
85.210.193.152
57.155.104.224
52.230.60.54
135.232.92.97
20.165.94.63
4.150.223.106
4.150.223.115
48.200.63.27
4.150.223.102
52.123.252.230
34.104.35.123
40.79.141.152
104.18.33.89
203.26.79.13
125.56.205.24
125.56.205.26
52.148.114.188
72.145.35.99
92.223.78.30
52.110.12.46
52.110.12.53

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report