MALICIOUS — 269a08aae5e37e8f1eb2ce5c243f36a54109a59e4dbc9208bfe6c9ca24286b40

MALICIOUS — 269a08aae5e37e8f1eb2ce5c243f36a54109a59e4dbc9208bfe6c9ca24286b40 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 269a08aae5e37e8f1eb2ce5c243f36a54109a59e4dbc9208bfe6c9ca24286b40
SHA-1: cedbc7adaa32211aaf5421c2297b741ab80681da
MD5: 9ce1e87ed3dafa5444d23c8b4f2a97af
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoziIk5KSt0G6T2A6vfdweQSQXZx:egKcR4mjD9r82elk/+SA+VweDYME
TLSH: T1A031F1B43028A389D362FD16748AF5FDE4136C4A08DDA5972A708D0EF52097788F7B60
Submitted as: 269a08aae5e37e8f1eb2ce5c243f36a54109a59e4dbc9208bfe6c9ca24286b40
File type: pe · Size: 42341 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2432 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\CMYY7119kZdUPnU.exe - bf7f76b2910c63675b8aae2d8623053abd019d12594e8e11cdf645e84a28bfd8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 80e2e6d88ebd50b7bf547ce3795cf6ba53b1457085f7f488580e5664eb665190
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 5ae80d7d57e2342693dece4b39a9683cad9c61929a5b87f6bedd01c59a902196
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 63c637efbe9786be30c365c1a1eff4a30ba6689de7c00cf51be376cff1659d9f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 9f917ad65e91833d9f8223210487323d0631b669a64e3a74c0c7662b2f15bee7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - c4145070b0e212e29e46588b1d508fa49290545a6aff4e144aacb76510490d88
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 91c373fa22ec7d8ad3cec78fec9884ba001dd9f70ed93c7154ab22291842516f
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - dac981d6eedd8b30391bd712892493fe6a4cca779d018fa299b37ffac30faa2f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 80b4d9fe682adff56fe17cc375d68007a083b815d2ff05ce785b5041ffdb8f69
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - fb2297c26d6c2c7b35ec924d35bd795a4f706f57a65ea50ba93fb1e018353a38
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - 6c9441d7d8c06dbaf10781801d86e753a94baba1dd38589f2275a9f0298e5140
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - a1a49aff082042a9ffc47b7bf437c35d9e4df1bf90e1346b3de9ad30be19260d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - a6955d8e0552cdddd507bb770cc5cbf9eb3ee7bb33bfebf30e46ba49b2b2913f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - d82372ca316ec5d9703a4b672fba881f7dd30377cf2d41cb3f98a8205ba74d18

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.105
20.247.185.124
52.123.252.203
4.230.171.124
74.178.240.51
20.184.175.7
20.165.94.63
4.150.223.104
4.247.188.224
20.50.201.206
72.145.35.107
40.84.97.4
52.148.114.188
52.110.12.49
52.110.12.55

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report