MALICIOUS — 20c3fd96a56ecbd64f06ad2409b22ab76328dce858de64256cdf1f598540a8f7

MALICIOUS — 20c3fd96a56ecbd64f06ad2409b22ab76328dce858de64256cdf1f598540a8f7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 20c3fd96a56ecbd64f06ad2409b22ab76328dce858de64256cdf1f598540a8f7
SHA-1: 188a6e9be31ff930fb5a26c053c30ff12a2cb5ab
MD5: 0f7683a09aaa09c1646bfeb31abd2447
imphash: 5ffb2aa7722009119a85fcb7499bf421
ssdeep: 1536:scNjQlsWjcdiTuXbELbGn82i+beox8XTX:vjr5ELbGnzi+aocTX
TLSH: T11D395ADD092A6A85C2B6DA326F141D5C5463F0AA1F7D350C3D83983F38E346B68B096D
Submitted as: 20c3fd96a56ecbd64f06ad2409b22ab76328dce858de64256cdf1f598540a8f7
File type: pe · Size: 90428 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.1
Kaspersky (KVRT): HEUR:Trojan-Dropper.Win32.Daws.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2344 behavior events · 1 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 3ccd41e23f99a29bb06273524571fa5167f071b8a7bae748749220fd14cfe6d4
C:\Users\analyst\AppData\Local\Temp\S2UefokxF5z65eP.exe - 38fb01a81b9dcf53472a62fc5ba0fdb0ca0143683269248084a07902df9e5913
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - d6daeb17dfa8b744d04db7d21c4ab2a7dc6ee034d3b359c117933910aaf640cb
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - dc9995329336b3710357c8d148f53d80a9e1e846a6297e5a2db05882ba97039a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 05fa490faf89b15040477c3e29583b934802c2ae91b9303594d960bf3b113763
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 66ac253b1c67e56197a4114768df29f5fa620e579eadbfd267c74a323e6d780f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 647c6b9e73a0464f262c27bdae00fa840b19a44bc9b4f0dd9eb6c45006d83087
C:\Windows\CTS.exe - 3293c5e8c2a49b5c7e2ba41c33e49d894137e25b672f19df5100bb9042bda402
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 6f59cf8d779d80a15a9b6b97cd866c93e661aa75ddcec5dbe4224601ffe7b610
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - c14e567d6e6f61ab8109b5ec2bccc9b4404d3bb9f4ba6d3c381619e86e3796d5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - d10eb8701d19b9cba0e7776f151fe359b8fc1670c5d67c9de81bf0a9ca919d5f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - dccdaf2913db66e4176c5a45f6bb501d9ba3baec10d49403fc83397f709919f8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - f81899bb376f585a040f66b200e1f5fc4f89393f6d567941f084cf8073924152
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 5f923b819e1b835c9d4f7ba4b3ad08f94becdb058175e05997e4ec74b5db8438
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 7a026a5f17bbecba791d8efe79e2bf5bdf1def2e0638e839ad0d0af9d2634d8d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787891775&P2=404&P3=2&P4=GGo%2fyHdIlYUyp8iA7wYSgVZfHTl9v9I456lI4plyNAmymF7r5fxem7kHXxy1M1NEaUY5t%2f0dBT574SNvkbR%2fnQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787891824&P2=404&P3=2&P4=ZBQBnf%2fOsGqaxXBTSQT8RKnD4qW5CpeOL5WhuThZ5aEZ%2fgFWTRlr688rbO6IlmnWgwD2trRonJ3RL31UMV%2bz9Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.103
52.123.252.219
20.247.184.142
20.42.179.192
4.230.171.124
20.42.179.204
74.178.76.128
52.168.117.171
74.178.240.51
74.179.77.204
20.76.201.171
40.99.133.242
52.123.128.14
52.123.129.14
51.104.15.253
135.234.160.246
203.26.79.13
74.178.232.29
52.148.114.188
72.145.35.107
52.110.12.26
52.110.12.4

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report