MALICIOUS — e7df306fa9b061aee65e8e02c24297fbf88836f0f243471a3a59316bd7f91801

MALICIOUS — e7df306fa9b061aee65e8e02c24297fbf88836f0f243471a3a59316bd7f91801 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e7df306fa9b061aee65e8e02c24297fbf88836f0f243471a3a59316bd7f91801
SHA-1: 8115a3f5a7326f7d4d7cf3202770f9bad41de284
MD5: ab6c912737cc55a6d17563e36ee006f2
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIovFAbGo5lwePgYT4eIV:egKcR4mjD9r82ok/5lwePgd
TLSH: T1B331F2716112D354E772BC18209DBEFE92132C8F1999A37B2D70C509A85182BCDEBF52
Submitted as: e7df306fa9b061aee65e8e02c24297fbf88836f0f243471a3a59316bd7f91801
File type: pe · Size: 42341 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2451 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - c53809b65a00dc2eb8d1621dd625748f24551ea0f4dd9588f7cf734ee2e7f38c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - abb14be501da4b9ec8544c15c788580fe825145991feb959abbee75ca529c783
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 35dec7371adf05e1d1473b74005a2e81a84a97175895817718f720bcd2fbaedb
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - fcd171ea66878c5baa00318f292b939865abe014c3fbd66a4ee022d7129e55e0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 35c2eff8da330eac330a11f5669631dff8267f1d7cb8739baef4504044024363
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 7350e54b18aa5b35bee4fc3147caf8c9d79f9045244cab4551df39d64bee7c91
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - d1df5dcfedb5f537e1297ea6c2b193eb426beab7aa8ebf163c3db6d17f4ea83f
C:\Users\analyst\AppData\Local\Temp\4pvffuJvj3xbyjS.exe - 7ef8827b716b28b7d476246535a2381a1af656efdba12843309d11551a7943a9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - 271ae93f37607af0e9291084bb859087bf27d452f324b30a42dedfb836810c50
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 175bf415b6a936ecdc215d1dd85ca4de02deb80201354d4e23982a5481feab8d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - fd733dd18b335f237860eb2bf6bc499c08cbb3f205a50398148d466f2273fa33
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - b5410785832eb9ff73caacc72f779faf4eaaf7c0b8aa785c262931ae788f7a5b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - 05d172da6950d3c82f010bbbd6dd9c22780061da896e3c12e7fb25f83ccd16e4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 6a658f392291577bee912f0e6536a67ba4aea13bad2a8e694d4af88468b408af

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.89.179.15
52.123.252.245
4.230.171.124
40.84.85.40
57.155.101.212
20.165.94.63
20.184.175.18
74.178.240.51
52.253.84.76
74.178.76.128
4.247.188.233
20.42.73.31
72.145.35.107
52.148.114.188
52.110.12.24
52.110.12.50

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report