MALICIOUS — 81caab0ac68812fa787597aa0c1c4648d457af4778ac0e97e81634ce54216da7

MALICIOUS — 81caab0ac68812fa787597aa0c1c4648d457af4778ac0e97e81634ce54216da7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 81caab0ac68812fa787597aa0c1c4648d457af4778ac0e97e81634ce54216da7
SHA-1: 6f4b99103a59691a8a102667f5e624021ddb130b
MD5: 2a9f991533af2d15d7751fa188f8f871
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoxUtu/yk+n9C75l2cBWDHyDdrf:egKcR4mjD9r82i/V+nA7D2cUDSDd7
TLSH: T1AE32F130B469B2DCD924AD1830CA26DFD5237E4A1C879BA31A65498DE0158F7C9F9F20
Submitted as: 81caab0ac68812fa787597aa0c1c4648d457af4778ac0e97e81634ce54216da7
File type: pe · Size: 45804 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2440 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - edf1ef2d1e598c42e2df7eca99c5eb9561dadd5645bb974a7339de48f7947cb4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 35b17a7851d1c221f0ac7626c093560f92dd009c4ed0ee92896da3f98d5a6b84
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - 79fd997651ed68948da563e549a276b71df492a81de45add8e90071cc01e1b4c
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - dc8d3aa7f3e8c67ba6fbf5368cb9a56bb7f89027bed6e6c3ae44b257a6d3906c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 4ecc286ff34fed8882c637d597a87b06822a45ecd47837eea90836c456ec7e03
C:\Users\analyst\AppData\Local\Temp\zCzIsNNjJkX9ZUs.exe - b930573ce8d412f99d3764f29a0996d11683514c05dcf0df438e6ce45aaee1e2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - cfacac6e4ae0c4982cbcaa5628b65803ed27ad6479b7e7cc769f46ba1532310b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - 01ddd8573d6b8cab2259b727c260fd6eb64fb0829460d0733643b26596e3101b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 7ec0bb3189df6cd65df5b0fdda6361777a02f082e3d023fe9c314c9cf6690798
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - 94d818a280872fd0f3331fc8edd07ab6f1ada57fd202775345d105668153b238
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 0dcdb7eba1f926b6c8ff44e51cb1ed9750e1a9d26e108530a07e1c8a543ec1a0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 8d9e2459d381a4c691f0704455806375719a51632222b9485cf3e958f33a3956
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 05393d9cc80b941c1e95e25e499f81268b63d9a3adbab8990cc34563338776be
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - a0e08bfb30eace73391c3bd47c790260ce0b95aafa59d9fc25a13a674709a332

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.98
4.230.171.124
48.211.4.16
4.144.132.223
135.233.95.144
135.232.92.97
74.178.240.61
40.79.167.10
4.150.223.102
52.110.12.49
72.145.35.107
52.148.114.188
92.223.78.30
52.110.12.47
52.110.12.53

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report