MALICIOUS — 9ec59cd9b7739b124d8be3753eb66a4e8284f229627a4691ecaa4715773912af

MALICIOUS — 9ec59cd9b7739b124d8be3753eb66a4e8284f229627a4691ecaa4715773912af is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 9ec59cd9b7739b124d8be3753eb66a4e8284f229627a4691ecaa4715773912af
SHA-1: ede2b36db6a3d279005ea2a2fea3523058e3bb8a
MD5: b4b018044dc4263e103ac60cc79df8d5
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIovgI:egKcR4mjD9r82OgI
TLSH: T1182EE0707036E34CE376FD0860CDBABEA1236D8B089956575DB0890ABC2447BC5E7B15
Submitted as: 9ec59cd9b7739b124d8be3753eb66a4e8284f229627a4691ecaa4715773912af
File type: pe · Size: 29606 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2361 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 8b989db4a47c8006ff39d49c6e9d5b1f9beeb067607d129d278ed343c50a05cd
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 4ce0b232e779b2f2e7e594c6f8671660c11547319c8e8fa46b250385c906559d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - d6814f21bfaa1acc1b28d4a0f29ee9828ec06966b39334680cb70c299416b3d3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 7f91775e4fe6b77b46f6774103b2c54f03c6f066010a7876fc60c0bb77f66c90
C:\Users\analyst\AppData\Local\Temp\BlJHH6xfe27zdCo.exe - 8b6259db41a984d77494d4bcfd5d302d4b1ff9be5941e928dead4f275279504b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 5dfae654b6d8c85ba875ba9df2a8bb38f76b5cf87eedc7103f1944b27775e03f
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - b8341d594a899559e51a45fad27052980a73ce049934613ac1efa824879dc956
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 28552065dbbab93c94be2710a7df764be638ad6327841a1458bb802bd592d892
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - a3a1725fd80b73ee89f193f210ba3410f873c63413f42f09592a6bb73230c4bc
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 48ae8a23ba6e3e73505ba0fad2103161a545ae7508e22aad8eab992a16782067
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 52b5d3b120214a7b4b3d0710fa147824f4d82580a3e44efa59a8d19ed628e39e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - d5441933115dc614d63bd13105e1fcf45eaa30c24c40a0f1e440cce3f4db66bb
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 3ffc1c265b227e208beba3d38813395eed95c6dc43725f4a195019eef3abc9cf
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - dc7a22ba6d3f3fcde4fc03966a63de12ae25e83a2ec46b972430cbb06ab04550

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787803555&P2=404&P3=2&P4=fexDzocAcOQ1tDskMwC9hbSyLZfTxm6ONZPvXlxCwp97f9nbpnT9AudKnCK2HTPkPCXi%2fPxXMF4fTxSQB7KSWw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787803670&P2=404&P3=2&P4=msHzYXs5%2bL%2f5bE%2bXpJ1MKNJb2mvYjX9CHk8s6V3Pc8wNLtp4j6YMro7%2bVUoXZ6gjyypEHkfRWiYMI4CaKm5Gug%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.114
52.123.252.193
40.84.97.4
4.230.171.124
52.253.84.76
135.233.95.144
135.232.92.97
20.184.175.8
52.123.252.240
20.231.239.246
52.123.129.14
52.123.128.14
48.211.4.16
203.26.79.13
135.18.128.211
135.233.45.222
85.210.196.11
20.42.179.204
20.42.179.192
52.110.12.2
52.110.12.22
4.247.188.224
57.154.63.210
52.148.114.188
92.223.78.30

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report