MALICIOUS — Velocity.zip
MALICIOUS — Velocity.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 3 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
916baab2b7901cd4fbbe689067b6c95940b0026bdf9fee27c6b3f9d91697f969 - SHA-1:
e4919ce1eeabf560c4b0246346c1e91c7d5efcc4 - MD5:
0f9c5b0487775b2e5f78cd8ca38926fc - ssdeep:
393216:/32qD6ihwHyrU5b5lpk0Y6HxxObz7qbENxNoA9XuZ43ydF54TB+1ft0ymB7U9k6f:/3RD6iJUjl/Y6Hxsz2OXoAAZwGF511V7 - TLSH:
T12F733341B33539C1E17C919B224B2CAEBCFF07E760179AEA54C79603A0FA5A7AC45407 - Submitted as: Velocity.zip
- File type: zip · Size: 22182069 bytes
- Verdict: malicious (89/100)
Detections (3 of 54 engines)
- capa (capabilities): capability:credential-access
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Trojan:Win64/Zusy.LVN!MTB
MITRE ATT&CK
Why this verdict
The malicious score of 89/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged Trojan:Win64/Zusy.LVN!MTB (rule
Trojan:Win64/Zusy.LVN!MTB) - engine signal, weight 0.55, confidence 0.85 - access stored credentials (rule
access stored credentials) - capa signal, weight 0.50, confidence 0.80 - capa (capabilities) flagged capability:credential-access (rule
capability:credential-access) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 1.0.0.12, 1.15.0.1 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Archive contains executables: Velocity/Bin/Decompiler.exe, Velocity/Bin/erto3e4rortoergn.exe, Velocity/Microsoft.Web.WebView2.Core.dll, Velocity/Microsoft.Web.WebView2.WinForms.dll, Velocity/Microsoft.Web.WebView2.Wpf.dll - static signal, weight 0.25, confidence 0.50
Archive contents (15 executables)
This zip carries 15 extracted members, each analyzed as its own sample:
- Decompiler.exe -
8424366adc15ddc7556b69cde78b32961eb37add186db364623c368fd0ec3202 - RobloxPlayerExecutor.so -
01f2d1fe1291438c7bb6cd8da5d7139a40a87ab8fc4478a1732e671eae51f1f4 - erto3e4rortoergn.exe -
5de4afef31595772624748037f5e8346a17c72100f1fde6f1a7f829d8110bdf0 - Microsoft.Web.WebView2.Core.dll -
2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c - Microsoft.Web.WebView2.WinForms.dll -
08c7014d311979c3e37ea56ae8233f3bdf363013498b11b1c7ee2bcfb29cf08a - Microsoft.Web.WebView2.Wpf.dll -
b6a200f3dfcf2cb6c3b6e6179da0590e01525b111e8f85b94c6060456102972f - Microsoft.Windows.SDK.NET.dll -
0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7 - VelocityApi.dll -
9945bf0b137c9f60e4fdd18e8d77b1e7c874936d6993d9e29b70820ba39a607c - Microsoft.CognitiveServices.Speech.core.dll -
62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e - adblock_snippet.js -
9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690 - WinRT.Runtime.dll -
bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db - XamlAnimatedGif.dll -
557f3e03f38beeae6e2c6c554afe6c7a763843f3571e7ba4afce75dc70a182a9 - WebView2Loader.dll -
df5816669f5123595c475d97929240d7d0e04f0bdc7dbe18af1dda42348b73a6 - WebView2Loader.dll -
8427b1fc58ec707813e5c0a51eb5d69397bb333250a7b891be4d3b123f1e0f1c - WebView2Loader.dll -
44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
Embedded domains
- bu.eu
- ud3.fi
- m.cn
- d.ai
- kt.au
- ri.me
- i.me
- 9.su
- f.jp
- i.br
Embedded IP addresses
- 1.0.0.12
- 0.0.1.7
- 1.15.0.1
- 10.34.0.84
File paths
- P:\zN
- A:\mJ
- U:\lU&1G
- O:\r
- Z:\C~
- x:\1S
- X:\F;
- q:\(8
- v:\QG
- c:\6
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report