MALICIOUS — 66c030727ad2944fb339e991fe361a921c54cf2e2f0df4c9fa41ed6047b48e7a

MALICIOUS — 66c030727ad2944fb339e991fe361a921c54cf2e2f0df4c9fa41ed6047b48e7a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 66c030727ad2944fb339e991fe361a921c54cf2e2f0df4c9fa41ed6047b48e7a
SHA-1: b6186e1c65f7df65f75b4046500da915d68566a1
MD5: 42335beff31225e1bb74a678397717b0
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIob:egKcR4mjD9r82E
TLSH: T1482DE0707032D348D376FD1860CDB9BEA1236C8B08DD579719A0C90ABC6487BC6E6B54
Submitted as: 66c030727ad2944fb339e991fe361a921c54cf2e2f0df4c9fa41ed6047b48e7a
File type: pe · Size: 29028 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2351 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 85992434f88edb67f6bdba53f18cc3c0938be3a23b2acddfd16ce0bb40fe3e08
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 13beb208df9a018e833600fb9388c18ce70804f052dc5d4cec8df8c2b295ce40
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 9c481917c5566ef943cca8f136377ed19b84a8a8a4d379bf1852d9252c5d349b
C:\Users\analyst\AppData\Local\Temp\Xetx6A7J0G7VQQP.exe - 3b525c01430abceb79fe275f663984078679b20db75f43aabc8659dea2f76b45
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 27442d06bc61d2e3a029ab5793489cd1906cdbbe1c76464eb481c1c0d983689d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - bb0ce7ab3436983310af3fecbfdbb6038081a86924adb82a10d4879789e9d186
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 5dc6ed165ef21400c8d7e49558f977ff6744213b6be65d4181a0d3cd94056e24
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - c8ee19feca7c5d010b5e6f3ac8d912f492288cacd189bdb9e08cea0d08377c99
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 9862ccf81f4ff34134965644f90b2e0efa3d32c6e415539506c1f8ed1ce77f90
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 70f19a8feb70b6f39eb912a3754502cb8bebc7697eaa8ce2fb7c43453805770d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 50fbba20228bc15acd2e5c2d5b8fb2b45dd88028ec9935b551a4a474b9e75444
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 8f9702677e06ce318a27e519698259f44f5d75a0d2a729d74d334e09ebe4424b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 847467e5bfb446b18c0ffc1638f0d72ac2e29349cb6112b4aeefd2a5a7e368de
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 4ea9115c0b624ef14b3bbd5930c66f27af536f4bccd360ae8abc03c89fd2c9d5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787939458&P2=404&P3=2&P4=iLYqHhqxOnVD4vNoxy9JotRvEI7Zt5KWJgoJYJ0Dx2Tnn1w0WRCCmA6%2fYkcvHhQEsm47citbWPjlmhCQsTxmOg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787939526&P2=404&P3=2&P4=GDyGp5DzpyaNz0yC95XC%2fCY7Uju5jo7oocB%2fuAUoICNPNVq3fZ%2bFtrZ81XtIyA5cj1YkEVDkK6tjS5ABKKJVMg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.182.143.212
52.123.252.242
52.123.252.234
20.247.184.197
4.230.171.124
57.155.101.212
74.179.77.204
20.89.1.13
135.232.92.97
203.26.79.13
20.236.44.162
52.123.129.14
52.123.128.14
172.66.2.5
74.178.76.44
135.233.45.221
52.148.114.188
52.110.12.46
52.110.12.1
20.184.175.13
4.150.223.113
72.154.7.108
52.110.12.4
52.110.12.19

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report