MALICIOUS — c607fdcbe3ce825e897998711463b75f54600578a95e3c0d4222e2fb1c554815

MALICIOUS — c607fdcbe3ce825e897998711463b75f54600578a95e3c0d4222e2fb1c554815 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the AntiDebug family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c607fdcbe3ce825e897998711463b75f54600578a95e3c0d4222e2fb1c554815
SHA-1: f1b15d679283869baaa2584d394648d71ef81568
MD5: 72b2ad8bf2eb754de728a34e3bf45a57
imphash: 0b978ec7715483bec18fb1fc3a2a737a
ssdeep: 1536:eEcNjQlsWjcd+xzl7SM+Gn8255NeoGjB:6jr87S7Gnz55Eoq
TLSH: T13D395ADD092AAB85C2A6DB322F105C5C5423F0AA5FBD350C3D83982F39E346B68B455D
Submitted as: c607fdcbe3ce825e897998711463b75f54600578a95e3c0d4222e2fb1c554815
File type: pe · Size: 92476 bytes
Verdict: malicious (99/100) · Family: AntiDebug

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.37912197
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2350 behavior events · 1 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 14cf61e58fe9bc46887443df1d6cc48b6eb9dd0ff62622bfa73db5c33b2e9b92
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 9f689f370b28f93e48aaffcfc14b0314579c11088531ff071d9d9c1f0a4f3da1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - b1ce85bea029a0dc1d009b72d956374781a6ac527379733ddcd89eb6dd734f55
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 70bc84fa8f7c5e80d886dd90406970e2e1a3fa459c2298a9b3c05896387d2f70
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 0b8b728d8048eacdf97aea785dacfe797ad331f966e8bd9da6e3b3ca0c5a8319
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 2ff3472ba015e7e19161ae5f99fbc85a6412e6f579a5c1a07874d7eac83a7499
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 596873f878c0bbf3a5577f7879dd039da2e96c38df76cecc97d3c67a0345a3b6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 86321d999332365b44218293046ffeadd40daf3d9a88ff79f4b2f9c92831ca65
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 6b3f58904bfa9b4cd8a51cfdd3292d6df4afc336ce8e5913cf600ca1cd6d20e7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - a52d79a8c1be862ca0840afd8f002fece7721d0c74dcda554c920c77963ab175
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - e88c6644213d5221bd1499b2726ad7429162561e7db664b3a556d216e8a2dfd0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 7aca3f940539b98d6863f7d4aabd86d1a0894a6e980f1be0e22309a2dd859a28
C:\Windows\CTS.exe - ff52d994f38f49789547cf1efe7c6a6535162c2ee1c405dadd229a6be1cf23a3
C:\Users\analyst\AppData\Local\Temp\Dwc2UxYd5oSqETA.exe - 6e9d7daa81e59a96711f3938470e8435f43e59adf2cb4a0464fb3e00f009e276
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 60afe072a2752a3d8b844b1a773212cf8fb24b1ecf01a40ef970c31f559bf3ce

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787920307&P2=404&P3=2&P4=ntBabjAU%2f2ukUyrGzX5s2tW%2fhfEddHuwZNZm9kF3qkauIRdL6cyrxQC7%2by5F1dDvwiooUwKKW2gKIpBAp6BGbw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787920378&P2=404&P3=2&P4=Xxn54ZAX31KpMdVk46MdF8bpWAsqBsyb6rfojJ5x6HCq87rvqVJ4Dfk9LNzY3yU6bYXZAzlab884FYDekWCChA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.72.131
57.154.63.210
4.230.171.124
52.230.59.222
74.178.76.128
135.233.95.135
52.168.117.169
52.123.129.14
20.112.250.133
52.123.128.14
52.182.141.63
52.123.252.224
135.233.45.222
172.66.2.5
203.26.79.13
52.148.114.188
135.232.92.34
4.150.223.104
51.11.192.48
57.155.104.224
40.84.85.40
52.123.252.236
72.153.5.60
74.178.232.29
52.110.12.56

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report