MALICIOUS — 931c4def8d8b9bb0bfd013b58b469f6e62ec9f5437afeaa71e53fe970e8b630a

MALICIOUS — 931c4def8d8b9bb0bfd013b58b469f6e62ec9f5437afeaa71e53fe970e8b630a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 931c4def8d8b9bb0bfd013b58b469f6e62ec9f5437afeaa71e53fe970e8b630a
SHA-1: 190d1ea01db82baf5a3af9545c30257fa7e5c94d
MD5: 8ebaf4d5f272b67745e4ba38749a0d80
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEF3ZwEMcJZhekOuz/X7rl:SKcR4mjD9r823F3RZj/rIv2
TLSH: T1BA32F170B4A6A346E3E1F80424D8E57D95031C8A58EE53D30DD09576BCA247F89D3F54
Submitted as: 931c4def8d8b9bb0bfd013b58b469f6e62ec9f5437afeaa71e53fe970e8b630a
File type: pe · Size: 45672 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 10 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 19 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7489 behavior events · 3 ATT&CK techniques · 32 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 89687522602f507f63e96623e78975555476993c35646c20546b7521361e95d7
C:\Windows\CTS.exe - 9d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B - 4770dc8005ef5a574cb6f1f0f80a96769230a4ac1bc154def2cb77dadec881f2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 357c1ebcb49d0c1d8d29cdf7f99c357eae556b7c1c09337129ec36dead949fed
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - a5bcccc73fba3b91a44d279f7a86ff0632815024c2ee3b1f850f2572e52ed361
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61 - 084f597a94af8071d6d19522cdb2bcca51ecc568eeaf10d2b191824b5ce68918
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 2abf8c5e8c61064ad6aa5021d838b2b47cf7d0b000a210a5c3d95d7adc58b405
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 1c931a2e5a36a81151e5c228cb8b0952eed1185329209f4e5e21d3ccf0e941df
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - a9cf7c90a4eb184b6e638bbf4f6bb48f291a88300dc0e17acef5ea858aa5721c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - afe4e7fabee5d79eed41928cc4667b6c7080156c0e8657b638e60cdec1e23e71
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 97a1bbb736a116421557da0e191ee9270bbcbdf67f04d572b20dfc3d925b9f87
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B - 0fb35f6ddd6834e1b3b032ba073b3e2cd1aee0e3e6590fc187907f582a41467c
C:\Users\analyst\AppData\Local\Temp\d7SIUPn1Wgwvae0.exe - 13c921999e5ff273007a610a8521bbc77d884b41d9cbbd41e045b3497909659c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 908c4e8f8b847a3c2cfb1e7ecaa8a682d66a43b58b4fae6ef34c2e9040fde219
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9 - 11a72a809860d4dd097d552dec4208fdf15d973591c3a359cd382b57140c8d4a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D
http://th.symcb.com/th.crl

Embedded IP addresses

20.42.73.25
4.230.171.124
52.253.84.76
74.179.77.164
135.233.95.144
85.210.193.152
4.150.223.101
4.247.188.233
172.66.2.5
4.150.223.100
20.42.73.28
72.153.5.136
52.148.114.188
52.110.12.14
52.110.12.1

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report