MALICIOUS — e4a70cf305f758a1f3f1b0dbcfb16d3baccba87878fc42b1a71c99d09b87f21a

MALICIOUS — e4a70cf305f758a1f3f1b0dbcfb16d3baccba87878fc42b1a71c99d09b87f21a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e4a70cf305f758a1f3f1b0dbcfb16d3baccba87878fc42b1a71c99d09b87f21a
SHA-1: 0534c2cef24feacbbdadc288880667d75c6790e7
MD5: 281ea326eda0eee6e319c895f0eeaa44
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 6144:S9co+8+IbAST1gLQVUNi5k1fIHZptbyE9PeXNdtif2/RL9OtbLWRgbS:Sn+O1gsVU8+gHZHyE9PeX/tif2pMB/+
TLSH: T1504523387521A28ECEA0EC4C20D9E6FE1B1644DC15CF07DD4AB067883678D9365F9E25
Submitted as: e4a70cf305f758a1f3f1b0dbcfb16d3baccba87878fc42b1a71c99d09b87f21a
File type: pe · Size: 282119 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2358 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 1e4bc731f2f970f40f43c387833495b0c35c709c5870a52ddedba026f55b4a91
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - de2909f5ae3d6a2a617c448b1a82b35eddb21a6c5c0785da41f4f7dda15e7dc4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - e1d14a017c35895ace190b68ff218d0c54b84a9c40c3e8f4793c97f14a985f5e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 0eb00fef9d932dc7342ccb9d1509387d30ee401ab20909bc181d4d3a4006d088
C:\Users\analyst\AppData\Local\Temp\Zrb5s0WJ5tsgzFG.exe - 4f0514c25f69e53e5847670bf68985f7398a168668e08ce48dd885ad5fb1da4a
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 717b82b51f5cf78c2fccc68e3fdab7b977717b3e7f20bec230e864d17c4745de
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - e4761f1ccd3d1f1d435de82687edf9ef47c4b4f6dc58b072e1fa50aa9c8b0990
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - b7659fa8c62ccd283474207134e3e6c69f4b79dbce7dcce2bf3095fcb7534c61
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 5e3d66c96a5644f7b3d95900d58486b90a3606671fdcead3adca737535b009eb
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 4dc2a0b9108b72f297e52d3bdcbd5a30f098dde09bd1beaf21ad847afc6de3ac
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - c2d378bc74b72ffdb3cdb93be84f7440c33338817fbcfa33861eb8fceb0231b4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - b252dedb820f2fe7175a988645ac0732bd2d01d73a7c539bbb4f05a90393ddaf
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - f9efb4013889474a03e6d5e5b4bff91a18045107074763efa9a619b15fd0d159
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - fcf13b2f8eef086870562635d8853e8354f81084a65a0f65080cb4cc3ac16078

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787789776&P2=404&P3=2&P4=EeWqj6Uj3%2bb%2bPKUoW8O8uESy9O7wQ5Qw5BFr7a5k0ZnbTe7DK4GH31J0QMxXkRXtRVe2kTh4cGYwScyET838Ig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787789822&P2=404&P3=2&P4=lvqkgJ1YbcWxIiKkInk0fhAojq5MOR1psHH2rPS8Nj%2fPC5xvlT7IaCBdbL3EYL3JOIlSznabuoT%2fqejHqSna5g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.8
52.123.252.233
20.247.184.142
4.230.171.124
57.155.104.224
74.178.240.61
74.179.77.164
52.168.117.174
135.233.95.144
52.123.129.14
52.123.128.14
20.236.44.162
40.99.133.242
20.42.65.91
52.123.252.244
92.223.78.30
203.26.79.13
172.178.240.161
52.110.12.55
52.110.12.51
52.148.114.188
52.123.252.231
74.178.232.29
52.123.252.202
72.153.5.131

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report