MALICIOUS — 913648581b302db5d427bca39b8a48bf79b690ee1ea4f0bf09b48c31588530a2

MALICIOUS — 913648581b302db5d427bca39b8a48bf79b690ee1ea4f0bf09b48c31588530a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 913648581b302db5d427bca39b8a48bf79b690ee1ea4f0bf09b48c31588530a2
SHA-1: d0f217fdcc8efffea7b7782de03da4a657a4f48e
MD5: ba57dc3f9986ea1b670d881208628a9d
imphash: 0b978ec7715483bec18fb1fc3a2a737a
ssdeep: 1536:UcNjQlsWjcd+xzl7SM+Gn8255NeoVKcR4mjD9r823Fai:Xjr87S7Gnz55EoVKcWmjRrz3Ui
TLSH: T1F23C8DEC082AA785C3B6DA222F145D5D5423F0AA1FBD350D3D83982F38E246B5CB456D
Submitted as: 913648581b302db5d427bca39b8a48bf79b690ee1ea4f0bf09b48c31588530a2
File type: pe · Size: 115378 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.5
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2344 behavior events · 1 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Windows\CTS.exe - 23f33569da55f7d02da96b7aa6a3d911937118cfff940aa0fc43de644d15dc7b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 3e470e305834b26a46f057337d5184f920e44aa262402d02cce995d238c58a03
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 1edf525c4ec0613e82ff182fe12fd4140cd2d412d6db38fbbbf70ad2aa7fa94e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - fffcc1a75fe542b62a1237afb40c679447ba8618905db584f1c4929fdd110e43
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 4f1c03fefa6984e297352630c3bdb2990850270ccfb4cc56be28dae06971447d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 03446ce570ca1ee727e96172144de0d95b38015725fa7451b26fe0815426f1af
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 49e3739f964f6e009fa0e5be64cc57eef44993037bf75e3f6adb9f4d8380c3a3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - f964dd43d850c33adb1e2a6a0319786536300649fc8c2494ebc86e17210ee2b9
C:\Users\analyst\AppData\Local\Temp\TQu7QYLzfpgkyG1.exe - edc8dd9f7a071e705635fe1eca151ad939ca33d8b4edae896fb37e0e4bce4d96
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 9ff1e3431da1c579f8cf594ee09f5098149ec3aaec73326509711a92cc08876b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 5c7706ef6fd2ee3c6aae223fb71f744e35d710b3d878de89da5f574392b39045
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 3e52c5341007d140a5eea7f93c11853ce204947d854076847a7f422f5f6d3559
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 00a2be5d01a9f245bf7ece66654387622030d148cf87c2ce9790ca62cff367d5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 8fafbf26c66f0eb93229e378569c8f4c6ba2365f29cdff8b94d6f85925373d6a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - eb78b5ef3eafdc1212c35ecf67a66b05f464dba44d655ed2d8ad9a684ee18033

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787904382&P2=404&P3=2&P4=d317Lblbipgmy0KxQMasL7uuZ9Sgy%2b%2feV2sv%2bwA9LNWR%2f4CxPHQYgo1nJ3OH%2bn8tiN2jlt4S93eUwzjs11aLXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787904461&P2=404&P3=2&P4=DDC3vBDabotiVwXBvBCTlpvKJw5PM5XfJLDvO5DVNlqhFDGg8wdiiP%2f1f3YakQqkdN6moxfoRatr91KDSyv2tQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.101
52.123.252.204
20.247.184.142
57.154.63.210
4.230.171.124
74.178.76.128
20.42.65.90
74.178.240.51
20.165.94.63
92.223.78.30
20.236.44.162
52.123.128.14
40.99.134.18
52.123.129.14
13.69.116.108
172.178.240.162
203.26.79.13
52.148.114.188
52.123.252.246
20.165.94.46
13.89.179.15
4.150.223.115
4.247.188.233
72.154.7.108
52.110.12.24

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report