MALICIOUS — e4054814bbec34db51ba0d1e52a33d9e192472b52bee7f9c2531170b94f25031

MALICIOUS — e4054814bbec34db51ba0d1e52a33d9e192472b52bee7f9c2531170b94f25031 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e4054814bbec34db51ba0d1e52a33d9e192472b52bee7f9c2531170b94f25031
SHA-1: cb8633fda3f1a52d09a33ea82776a0d8e84b3cc1
MD5: 07b5e1a3cf268c180626acc341e27e94
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 6144:SXfWwpYJDm5VwUD3xG2rT2oQKnEhCosD5jh:SvXpYJKwUzUhKnEhSDr
TLSH: T136452350F8707AD0F5F08605CBFF9B3E12265A0B1DAAB08B4578074CB1A4D6726D97B8
Submitted as: e4054814bbec34db51ba0d1e52a33d9e192472b52bee7f9c2531170b94f25031
File type: pe · Size: 286215 bytes
Verdict: malicious (98/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2351 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 85afce774dfb0f31385327e5b850a781d5b14714eec1f650ef8696d40b73b75c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - e908bc090b53369c4a9535f50a29352cf39e78eaa319b682cc113dacd5b0851c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - d4e69f6eb06726238accd6180cf22bf7935edc98c3e42798e87e7134139c9480
C:\Windows\CTS.exe - 9768adefcfb9e4781b55cee28b2dd5db68086ad998b70c82e8b2a6c3f4b56c53
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 3f6a07e9cf83c227a4d64c3ceba970f75ea94f9acb3d83553d7c875b6c3c9f24
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 294b1902747b117dac381a1264a061fa701061533189f240e5f17d619aaab7ea
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 1d41924ee8ff802fd8c31a6c70c9537abf330e61e112da42f0296fc566f05966
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - e156130956658fec330321a79b5d914e6bc6705f57efcde893d6e3fff94fbb88
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 949f3b245d603bdc184ac733e3dc6079d007fea7f38f3f9e10b6a10e70a2fddc
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 57f948b519016fb9f47b893b7f3c2187928b646993e4da3f4cce5917beea5406
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 5b891886ce387457a748c7ca85f7205bbd1d2e478b5a5aeca160d7f56345a875
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 4bff56b5143441749a46fbd74434b15172239ada3ed75f46735ebd70f640627c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 02a4192008227c31c97998a52fdbb7be0aeef011e85d8a07f7c794b50bf6ddee
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 2e9962b97474c1dccae2ea9812d4c7cdf1243425735ad6f43936e8d8f1f72bf9
C:\Users\analyst\AppData\Local\Temp\l8OfZBT04va1ZDZ.exe - 87bfce5cd335c7b5bbdbaf822684085bd745d781149c2da1a252342ad0365d65

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787832387&P2=404&P3=2&P4=cdErMT%2bMx0xwLYHIkNbeXC4lPoVw%2f26dRGdGYjIVNH4BsE1DVmDC%2bhKon4mitRkHIS0gaRs3%2fxPumd36aZDkVQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787832458&P2=404&P3=2&P4=mYfAwN%2bkUznNTDSMwFGedcVEyLgWWbEm023IgwdIHggFOdLqG7CHFr38G0uUzs4Nc3h8qxw9ZD635b4LzoP2ow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.89
52.123.252.212
20.247.184.197
57.154.63.210
4.230.171.124
74.178.76.128
135.233.95.135
52.168.112.67
20.236.44.162
52.123.128.14
40.99.133.226
52.123.129.14
20.42.65.88
135.233.45.223
4.247.188.233
52.178.17.2
51.116.253.168
52.123.252.229
203.26.79.13
52.148.114.188
74.178.232.29
92.223.78.30
72.154.7.98
52.110.12.1
52.110.12.52

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report