MALICIOUS — 546367a00b92bc2657170b596e3640427bc24100d1b05573e97c5f65d0c7ac90

MALICIOUS — 546367a00b92bc2657170b596e3640427bc24100d1b05573e97c5f65d0c7ac90 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 546367a00b92bc2657170b596e3640427bc24100d1b05573e97c5f65d0c7ac90
SHA-1: 9f7ae74238abc5aeaf8df15a2f52ce47999fa502
MD5: d1bda7e87fbe0928d3db08f354e42ce7
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoVW2:egKcR4mjD9r82o
TLSH: T1CF2EE0707022D348E332FD1860C9F9AEE1236D4B199D52971AB18A09BC6447BC6E6B14
Submitted as: 546367a00b92bc2657170b596e3640427bc24100d1b05573e97c5f65d0c7ac90
File type: pe · Size: 30259 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 20 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2355 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\q4pvyVMneadIyWS.exe - 6d8ee4ca0877dc52975db713383ae3a4bc79951b87758af85a8d873862238bf4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 3dffd93bbc9527e82bc2d3a2407bf86df92c0cb1e7e216e4a96c81a342369107
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 482b8801619d2540db3df44bc7683a6bb0231df903b58fe2322b419f68ae48a5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - f269ab5c07cace1c83437de61fb74b4fb5f17cacd61cb103bb13911384e93e95
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 6a28d3b8d6e42a1f3fd18dc3a8805243285f43b7c42444d4c163812e9bb10b61
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 7d23165119b4da913cb882546a1130942d5d85679a97d405ee22522a875dca6b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - f6793ee5b55365fcc2c1714be8f1ad1bacc0cd5697d96dba913178073f4a2af9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 32ff27931c53056d15bb8ed2011ef52458b0f800f7293a5e595d676ab127c661
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 697ff2929ccea15ab204ed86c9dae5339ce4263f94ad2b58a9edb87ecd171927
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 4a0f1e4d8ff3d12a13250f8122dfe3d8486545c6e621f4433e8910a3802064c4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 19df9db8e70e21e070ab7ba8dcd139991472a9966e931026bf895a3762f04eb0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - a48cbe8b5429b3ce6866f067ec0552e57795d54345c5d27f392190cc853ddc89
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 7601aaff4590b35a820ea20e8d9365c9d56538f15811e4327a83dd3f70b5de1a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - cceeddb548f25f3ecd30d26be547026bb7e59d1465e764656f57cd4da79a07ec

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787846449&P2=404&P3=2&P4=BJTaF9Z7w7FR%2bAmL0eVkPumqHcTlZtlpDtB99Y4KGEyOb6nfL2U852%2fGCuEKnUaUe5RFnBuFpwiSkORQn7RDxQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787846511&P2=404&P3=2&P4=k1vz2uQoQMbN2mvUAukUlfNtVrPG%2b%2fLfbo%2f%2b4nK3694xxuqjD3c2JeWAd3dmJ67niMopHPE5L23yJFhu8XA3Kg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.84
4.230.171.124
85.210.193.152
52.230.60.54
135.232.92.137
135.232.92.97
4.150.223.104
74.178.240.61
52.123.128.14
20.76.201.171
40.99.133.242
20.184.175.4
203.26.79.13
172.178.240.162
172.66.2.5
135.232.92.34
52.148.114.188
72.153.5.141
52.110.12.10
52.110.12.25

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report