MALICIOUS — fffd00028fb0f267281b44c568b294827cb7b85c30008c3f9856d2db50cb146c

MALICIOUS — fffd00028fb0f267281b44c568b294827cb7b85c30008c3f9856d2db50cb146c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Zusy family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fffd00028fb0f267281b44c568b294827cb7b85c30008c3f9856d2db50cb146c
SHA-1: e48a40dc8f672070851ba89e4506bdb89beb9498
MD5: 5ad37c4bd0872779ec41fae09a113540
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFkdtjyDWnGYZJqnMNgfL4D9RT9ZyGc:O+K88uPCH8tjIokMN88DHyGc
TLSH: T1425A23958A2A9F4CE7F2D581280A26BE8042F4D797BC08CE428FF01D73D7967647119B
Submitted as: fffd00028fb0f267281b44c568b294827cb7b85c30008c3f9856d2db50cb146c
File type: pe · Size: 2089472 bytes
Verdict: malicious (96/100) · Family: Zusy

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\E913.tmp - 88885c84198210e0f83b90918857cbdd8fcfd8662947e389db40542539b9697a
0ca76a57b25ba2b5d6d67379d6fb97751cb8b49a790f9c33337e94e5f8c8cb70 - 0ca76a57b25ba2b5d6d67379d6fb97751cb8b49a790f9c33337e94e5f8c8cb70

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787857886&P2=404&P3=2&P4=iy8Xb41PwmBBWQlJdm1UAvfdUWn9CWZn%2foX0Oz6vWYTpdKGJAomJIGtHcorEbiC%2f3Ci%2fkaPAxOaBdML5pZWCMg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787857958&P2=404&P3=2&P4=QCHL%2bC0gSVqvTfYml5WE7xdJTX3jd4d%2fzCiKKb3di%2fdfQK%2fgQ5Fe4AoOJKGUYW0%2fj%2fpzBH0bKCWj2JI2HYsn4g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

vry.gg
schemas.microsoft.com

Embedded IP addresses

52.182.141.63
52.123.252.198
40.84.97.4
4.230.171.124
52.253.84.76
4.247.188.233
74.178.76.128
52.168.112.67
74.178.76.54
20.184.175.3
20.112.250.133
52.123.129.14
40.99.133.242
52.123.128.14
52.123.252.239
172.178.240.162
203.26.79.13
135.233.95.80
52.168.117.174
20.42.73.27
52.148.114.188
92.223.78.30
172.215.188.225
72.153.5.133
52.110.12.32

File paths

p:\{

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report