MALICIOUS — 0d6333a08666d931250077d503b629b98029e98bb5f86bb9ff5ae2adb44826e3

MALICIOUS — 0d6333a08666d931250077d503b629b98029e98bb5f86bb9ff5ae2adb44826e3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 0d6333a08666d931250077d503b629b98029e98bb5f86bb9ff5ae2adb44826e3
SHA-1: 7387300f887598995095aa131c713a754489f83e
MD5: d9a246ac8236ef5000923d6ce1fe1b17
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoobW/3c6NJgETI4nQL:egKcR4mjD9r82tbW/s6NJxc4QL
TLSH: T15032F134A026D328D3D6FE09208FBD5DE013588E0DA9539B08A25D15FD6693F96E5F08
Submitted as: 0d6333a08666d931250077d503b629b98029e98bb5f86bb9ff5ae2adb44826e3
File type: pe · Size: 45804 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2429 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - 91b1262c881c375cdb94267dae544449f36ddf424d276d8040a43d8df215dae9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - f487a6731fe3ecb1c1cf9b58d568773b6130032f46bb2dcf00aa93d89464d0bc
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 5571f38f993e70d8b0ad705b205e8be9025312188d2c617d9a8416126423e029
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - a7b125094a853cee186a2abfddd34d93d8138b6d46955a84bafc25c75df35208
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - 7cc99873a4a686f7b8902c83c03cb62ded62ad7e9d1f5f47541ff3b66a19a0ca
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - ff203dde4a7ab6e5684c75339580a67d97a2cc2b2d1d5296c7c36400b441a566
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - e74fae8305f844a154f6ef3df053d22231f97988cb173fae7594716e12af99af
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - c0e2a1729e02b927446c9ef3c0cc1b5b05669ad9de04aa6697b57060a7bb6128
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - 22e42e6f89aafad3ebe7fe2ecd1d5d81b392b399b4f8e2636d584aac7c7b88a6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - f198b7c92924eaf0fb9e2ad6a566b35ba1bf6bdf1f7f0a5938f2a82ec661c797
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - f48fd491da31a90b1f4dd3ceadb7f9a3e46cdc5128c1b618b1f83c92fec87888
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 617a6961cc4c675859daaa8760d35c55902830e8195ef6e9fc5ae669a8558b62
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 513b6e52a22628569b92fc408f938d20edc712d3978fa183f7238687a570bfeb
C:\Users\analyst\AppData\Local\Temp\JEgPLkEIFzl9zRw.exe - 088e3cf0eaac4d219e0efac1572b46c2d3b0a93a4c3557a7f68d853a972dd73d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.50.201.201
4.144.132.114
52.123.252.202
4.230.171.124
4.150.223.99
4.247.188.233
20.42.179.192
72.145.35.105
52.148.114.188
52.110.12.24
52.110.12.14

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report