MALICIOUS — 3b0d9e4090b56c52599256ec8b259276abf98e7a531fc202ed471eacde35f0c4

MALICIOUS — 3b0d9e4090b56c52599256ec8b259276abf98e7a531fc202ed471eacde35f0c4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3b0d9e4090b56c52599256ec8b259276abf98e7a531fc202ed471eacde35f0c4
SHA-1: cfb9303225b267cfc5ffb37c907074655df2f312
MD5: 61dceac5f7ffbc9319ea7e493bfe7b1f
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoe5zYIbg2GtmrBye2GJBiW4Gn5c:egKcR4mjD9r82HzjUD+zViW4Gu
TLSH: T13C32F235B8317348D376FC3860DC69BE91233C46096A62231D70C909D8A86FBDAF6B44
Submitted as: 3b0d9e4090b56c52599256ec8b259276abf98e7a531fc202ed471eacde35f0c4
File type: pe · Size: 45804 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2352 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - cb0e176991c13cdc792a8dfc657284b015d322917f448e06ff529ad60f0df6a4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - c55f3f31c3333f963b9812a2bc6c8d6064179892093ca4233f3a496bd418570e
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 382015d6f5f3e6251c17cac943dc0faf25b8a30822d199e39d30b3d2d5b6b73a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - b425cebb13c440fdee788a6b9b33642c18f22e4a62a65c7bfa397ccfcc830407
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - ed9db6f3a3f8bb127530fab70ce7ccf73d85fa7e909b97d8f04a898fa72a4af1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 142b7956cb1dd2b7f29fd3e239e417d22ef0e1f434ddd7f7a223244f0207974b
C:\Users\analyst\AppData\Local\Temp\suh7XLKVTDkTJBC.exe - 83ca77365934c1887762ce77e349c30759e8333bd1ea650280fe50f6df74f45d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 99be6bd8872a748ca39682dd02fe3f120dafa78e08292b838814cd0d9bf9ca0b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 79fed7b47f292622f36035994d1fa498675d322248518973af9790095c47d269
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - b29b455300d9ebb1bf2296aa065e3df40548cbe29ccd5f1dab6939f2145e8541
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - e31232fdfc9ec75d017c87c84b4a47c23d074c5b335047bca5e158b95af9fbd1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 09f019a5d0aa70088602f3d2a0a65d57c5f330ae2dd7c9e5e9a864d45a408901
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 4e41e02ab9e974b751d2cc6c5af75acac2c0f8455c264878d85aadc95ebc3d16
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - a754ea7ddef2f591a5233e67def0017e4a507a7a27670f05d225601148dc2cf9

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787790962&P2=404&P3=2&P4=NL%2bG%2fzNDo00jGvlyuxi3unT7MrRXN%2b4QpTXnvlYXFNlyc4NKIwiQ0JqFLjIQhJT7zwUrG50ifPVT%2fJ2yZFsEgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787791027&P2=404&P3=2&P4=ky%2bKwTdZbmW9Yz%2bcLarMR%2buj39m98idxyccKTDoZfDmuRYqf61O8%2flpFmihHR7qynotYH%2fHuOl0c%2bDS%2bX7jl0Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

13.69.116.104
52.123.252.227
52.230.59.222
40.84.97.4
4.230.171.124
20.165.94.63
20.184.175.7
74.178.76.54
52.123.128.14
20.236.44.162
40.99.133.226
4.207.44.65
52.123.252.226
135.233.45.223
203.26.79.13
52.110.12.32
52.110.12.14
52.148.114.188
52.123.252.239
74.179.71.159
85.210.193.152
52.123.252.195
72.153.5.137

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report