MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943
SHA3-384 hash:	076dffc21f316ad96ddaf3585a7c199ba6d8213bc863ec287b18f6720e82a2b7d40e8332fa5c733aa2585aebd3b1ef31
SHA1 hash:	056a8309ed4c51c11d841c136e8e9d4d40b0c347
MD5 hash:	a29ccdfe75b6d00c5af0d219040ec8fa
humanhash:	river-steak-magazine-early
File name:	SecuriteInfo.com.Variant.Zusy.104930.17498.20700
Download:	download sample
File size:	15'360 bytes
First seen:	2022-07-27 23:58:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	384:TQQ/DoACPGLm4aFc/9tLpPc9syYr3Olr:kQ/DJuc/2ZYr6
Threatray	1'071 similar samples on MalwareBazaar
TLSH	T1D0622A1953D8C271CEEE0F711C2251401771DB25EA43A72F9FB4A123A9A726A4B73A60
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

250

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/294763/

Detection(s):

SecuriteInfo.com.Variant.Zusy.104930.17498.20700.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed wacatac zusy

Link:

https://www.filescan.io/uploads/62e1d1bf7dd0cb902f07e2a0/reports/c96f369c-9a9a-4aac-a493-a1fadfbe9117/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/0ee095ff-190d-485f-805f-b2a5739418fa

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1042176

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943/

Threat name:

Win32.Trojan.Zusy

Status:

Malicious

First seen:

2022-07-27 10:46:35 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

8 of 26 (30.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e6s6oitothp5n4muavs4dhtb57huaryik2j3fsgenzooqq6b5fbq._file

Verdict:

malicious

3e065cb08c3849a2eefd0ac3037f47aa958e106179976c11fbeec34a6f0593d2

40e593b8ec5b014b56d4b1c2572b11385ee2151ddb73dc7ee8a2ef4a7fb1bae8

51aa074a2328e0f001a6783b60d168a3bdc61dfc0248a32427fad1e096364e6c

823eb07c909c332450374977a21f944ef0cbf2bed7403971053fa4e61b3b02f2

b63b3bdb3a17fcd705b77c85d36db8a300770b267979b70cf2497614df5a4445

c2a8b81591a60318a09bcfd8d403cd7ab45018d40457e7ce7a86d2b1a4d6ac27

c3bec42ea8ccf078389aedf4292eba41e512c7e1103a86f7135adce541380ec4

dc8a2332c245f1019a3c08c53f649f0bf1ea42fad18c90fea68ac4aa1eb387aa

f12589613148fd8c49340d2a052055a904eebcb6be0139e88c195199e017ee7c

+ 1'061 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220727-31qdeaaghm/

Unpacked files

SH256 hash:

27a5e7226e99dfd6f1940565c19e61efcf4047085693b2c8c46e5ce843c1e943

MD5 hash:

a29ccdfe75b6d00c5af0d219040ec8fa

SHA1 hash:

056a8309ed4c51c11d841c136e8e9d4d40b0c347

Link:

https://www.unpac.me/results/f5347bc1-0566-4b22-bbdd-a2d6e01e2b15/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.