MALICIOUS — 6b950ef2ca5a2f990bee4c454a26cf13ed2bca295195ebb2b4be5f5f572970c4

MALICIOUS — 6b950ef2ca5a2f990bee4c454a26cf13ed2bca295195ebb2b4be5f5f572970c4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 6b950ef2ca5a2f990bee4c454a26cf13ed2bca295195ebb2b4be5f5f572970c4
SHA-1: bbed5f7938367d608d659fed86ca958a1393b910
MD5: 8203582d9b2ee6074fb5344989484364
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIo6NY1mRr8bC3a8V3vaUsMR:egKcR4mjD9r82/hQGjJanMR
TLSH: T11132F17030228148E3B1D929B0C9777EE763884A5DBD67971DA0DA1AD5C146FC4D7320
Submitted as: 6b950ef2ca5a2f990bee4c454a26cf13ed2bca295195ebb2b4be5f5f572970c4
File type: pe · Size: 45804 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2354 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 3d5e85136a14ce6bba0d5fc0c79c5312e4416d9ae2d8d12027043e71638ea4b3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - a0e7f877006653bb18fce21b404d250daf6d5ad6f879f11db94f84979bc0f1c9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 3068dce573f4bfa6627c5d5d6c5f5ab8a4817b8c2aa151e32953958288f45987
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 88b8d6615b996f59364ecf879b08c646cde4d7eb790ec047f40a12ad390f5a36
C:\Users\analyst\AppData\Local\Temp\NMFX7v5w8ufkmAc.exe - 73d0877a72fb2bfdc29e88e5f885745a1d16e45724e758239b1882a327525f04
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - cb0cd63ccb5781d9955857a4f2302158f1b903542e244008af23e3d515cdb3fa
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - aee507f9c52ef0a5bdadf1c4c200e245e34c0050a50f5950dc2dacc07c1dc897
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 1d422f543465c2d456a6cf7e7e915911c33becf70e61654159f3598481fa42a5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 7aa29558f91cb9061e3281bf362ab85e3bbf982f8c96559dc72bb3cb8f5fb2a3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 82d3139b9fb390b032164cf185c9185ae92b25670d6bde7b83d190ffe55dd959
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 793588079c51b84995e09c3f22d317906a421879894b78e58156c3855a1f7c6f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - a75a6f42e28e3f0600d10f7e07e47cc27f2a98ff66e94c7df08255dc0d1e98f0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 2353ddad6e22880d0e1aeb52628e3c8dc0ffe2813ece1dc6369320ca3006fc04
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 94f201d752c982d3b276fbf5d02b8cd853115c53f72735f56651f431632a3bbc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787814638&P2=404&P3=2&P4=bs%2fR4JYsnRbMWMNwicswOHPcPuRFP0GHR09%2blV3vP8llLnLx%2fk9t2hOOrfgLdI0dVq3yvF416bJpf7eEFe4pSQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787814654&P2=404&P3=2&P4=jHjdRfPw9tq7Gm%2fAIXV3cbCxI04OFkam2rEPFmOnJk%2fxGFednE6zoHI%2fO%2b9aHyIo69QXIeg02UJvC49vk1yJIQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.93
4.144.132.114
4.230.171.124
40.84.85.40
40.84.97.4
135.232.92.34
74.178.76.128
4.150.223.96
20.165.94.54
203.26.79.13
52.123.252.203
52.123.128.14
20.236.44.162
52.123.129.14
4.150.223.110
135.233.45.221
104.46.162.224
20.184.175.6
52.148.114.188
52.110.12.48
52.110.12.15
125.56.205.19
125.56.205.32
72.145.35.102
92.223.78.30

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report