MALICIOUS — 308ddc3460a185b34023ee72877a8e8c4a2360c7007d1ab75e4edb9a8fa1a66e
MALICIOUS — 308ddc3460a185b34023ee72877a8e8c4a2360c7007d1ab75e4edb9a8fa1a66e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
308ddc3460a185b34023ee72877a8e8c4a2360c7007d1ab75e4edb9a8fa1a66e - SHA-1:
bebb707f1d2677b4a1f8b92c73fe8042317936f0 - MD5:
7c2a659353a9a600e2017392c26f9a04 - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 795520 bytes
- Verdict: malicious (98/100) · Family: Zusy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
MITRE ATT&CK
Dynamic analysis (windows)
2358 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13237/files/ba681a10c5300ae70c9dfa2fca64311e140f56ae2bb24865f41397953785ec36 —
ba681a10c5300ae70c9dfa2fca64311e140f56ae2bb24865f41397953785ec36 - /opt/CAPEv2/storage/analyses/13237/files/d7112c292bf52c080e8ad1b5cd301736cb3f563e2463c36d5c9d3d900099253d —
d7112c292bf52c080e8ad1b5cd301736cb3f563e2463c36d5c9d3d900099253d - /opt/CAPEv2/storage/analyses/13237/files/733cedea622b973cd45cadeb329dbedad02786404e43405d0432aa995903bc63 —
733cedea622b973cd45cadeb329dbedad02786404e43405d0432aa995903bc63 - /opt/CAPEv2/storage/analyses/13237/files/be2c98411a4ec05dcd3697a5965a1a1e4318e91d3097b6cb51baba70cc5a70c2 —
be2c98411a4ec05dcd3697a5965a1a1e4318e91d3097b6cb51baba70cc5a70c2 - /opt/CAPEv2/storage/analyses/13237/files/fb0ccca47d506d08de466c3f0687c1e20a393eab31174cfc1e1d6f49aa5da8c9 —
fb0ccca47d506d08de466c3f0687c1e20a393eab31174cfc1e1d6f49aa5da8c9 - /opt/CAPEv2/storage/analyses/13237/files/b46808eab61779a974ecc5d6296038e1a9a6fdfadcb0db8b746566c2910ba2af —
b46808eab61779a974ecc5d6296038e1a9a6fdfadcb0db8b746566c2910ba2af - /opt/CAPEv2/storage/analyses/13237/files/8d41e573dd4e4396451d4f009d74c4306e28bf7cfd06512f05e11af22466f84e —
8d41e573dd4e4396451d4f009d74c4306e28bf7cfd06512f05e11af22466f84e - /opt/CAPEv2/storage/analyses/13237/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13237/files/7658eb6af72dfa4f08996756086434a15a03784eadd9ce589b0244ea7754241f —
7658eb6af72dfa4f08996756086434a15a03784eadd9ce589b0244ea7754241f - /opt/CAPEv2/storage/analyses/13237/files/6265bfce25068c66442ea447f88245112ef3ddfdca5148acd4cabad8588a5851 —
6265bfce25068c66442ea447f88245112ef3ddfdca5148acd4cabad8588a5851 - /opt/CAPEv2/storage/analyses/13237/files/fd6584e7439dfae2c6ceaad1a45f6fb68925035b34000819575ae8fb4222698c —
fd6584e7439dfae2c6ceaad1a45f6fb68925035b34000819575ae8fb4222698c - /opt/CAPEv2/storage/analyses/13237/files/dd21a05d6f086b2b618d9a39d1e61e91588d077f734aae8e69ce4cbb930da453 —
dd21a05d6f086b2b618d9a39d1e61e91588d077f734aae8e69ce4cbb930da453 - /opt/CAPEv2/storage/analyses/13237/files/d180bd6a25a73baca5553308e5794f16003f9c70beef19c05b49e5683ae11f44 —
d180bd6a25a73baca5553308e5794f16003f9c70beef19c05b49e5683ae11f44 - /opt/CAPEv2/storage/analyses/13237/files/3993a9a5859eb14b580e654ee27239995229b60c71122f1ab1c9af5d0dfe1b9b —
3993a9a5859eb14b580e654ee27239995229b60c71122f1ab1c9af5d0dfe1b9b - /opt/CAPEv2/storage/analyses/13237/files/7a3d8d4165199f1151c73bb5ee16ec08fdbd4199a6f1f3c2b4a9763e35badb98 —
7a3d8d4165199f1151c73bb5ee16ec08fdbd4199a6f1f3c2b4a9763e35badb98
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786542691&P2=404&P3=2&P4=mH7l2QCYnuS9Psaoj50O9MFStICpTHuYvZzvrVyIlzhO2QF3PW7DAN2L6rWrHZhEtvkjqeXN0Q9FVRxYDB0Fbw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786542723&P2=404&P3=2&P4=XjpZn5Nb%2bphpu3MWiQOEyPyLjB%2bJPA7Wn7SBkBcGSCO2V3jvReUoAaFeZlfutwmwrZGuIWcweAjyJDRJdyaozg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.184.175.17
- 52.253.84.76
- 4.230.171.124
- 85.210.193.152
- 135.232.92.137
- 74.179.77.164
- 92.223.78.30
- 4.207.44.67
- 20.42.73.24
- 135.233.45.221
- 203.26.79.13
- 135.232.92.34
- 52.110.12.15
- 52.110.12.47
- 72.154.7.106
- 20.184.175.19
- 51.11.192.51
- 52.110.12.56
- 52.148.114.188
More Zusy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report