MALICIOUS — ef2117451fe03e7bdcb855dc6a21bf89424fc4a9c6eb38b5e28278d1bcd59ebf

MALICIOUS — ef2117451fe03e7bdcb855dc6a21bf89424fc4a9c6eb38b5e28278d1bcd59ebf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ef2117451fe03e7bdcb855dc6a21bf89424fc4a9c6eb38b5e28278d1bcd59ebf
SHA-1: d53f454bd4171197ee72cb6d1f5385adee774189
MD5: 1bf691baa78098d086ffc17fb77a1e99
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocT7qDTxJdZqaTNvKqiv:egKcR4mjD9r82bqpJPqP3v
TLSH: T1EC320138706AB388D266DE09704F745EF2632E6A457D138B59F0CD0BA860427C6D7B50
Submitted as: ef2117451fe03e7bdcb855dc6a21bf89424fc4a9c6eb38b5e28278d1bcd59ebf
File type: pe · Size: 45804 bytes
Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2444 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 5a8d69e23f2b2b2e124697ca4881eb1afa98b9c4494ef5967deddd5714a30763
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 9496153843fe62f899f4e692f9a74d5e5c4ad48c0a17cff29b46b5aa133fdfe3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - badbd91d9b3a06d617ea2445c3e1fee770ce27c2812d4553603e81c2fd628236
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - 1ee1a5ddb05eab4e8a6610225d0e749a2fc8ad92ce99b6fa89f079d19721a667
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - 86502d96615ab12b394a98e70efbcd4bdf4077a9a9479d9b0996acd4b2ce7402
C:\Users\analyst\AppData\Local\Temp\4KqEqRCTeXPmbW5.exe - ec46f1b299f1052749b743dee6a35fa98dc38b1ff5d709bddf35da5d1f347668
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 2d0a2e041e98c662b08ac29db44bc5b0dbbf6d201cb1b2ca6c7ad33004da87c0
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 0d1dcfa558a9d80a6536dab66673817e62ff376ddeb1d5d8fa9a8c375eca21c6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - c38f8fc7b241be4b21876aa0afa6c373abab5e5e2887390f272ba739a23d6d71
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 05b34bf3b2ccaa2e660a1f7e31134579f51eb0f24e2df2d08a5da00ac3f65e35
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 4ad72767e49f797711c163a5607be12364794d76d501088cd5e861371b1477d6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 231d9965c26f67fefb5dd93e300074827e345963b1ffb980202f44820d4e7ae0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 5c459920fd7033debb876053098436a79b5771d13ea6eccf0332624321fa130c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - ddad580a54ccd339a33bf2562e676b6f728f036bb571e76df3e21a3132fc7de2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.89.1.9
4.144.132.223
4.230.171.124
57.154.63.210
20.184.175.12
74.178.76.54
74.178.240.61
20.184.175.16
72.145.35.98
52.148.114.188
52.110.12.53
52.110.12.14

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report