MALICIOUS — 4c63acd06871a7297d19a3e3a2ce03f4af4ecda7dac9e013dd6197fb49d2b701
MALICIOUS — 4c63acd06871a7297d19a3e3a2ce03f4af4ecda7dac9e013dd6197fb49d2b701 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
4c63acd06871a7297d19a3e3a2ce03f4af4ecda7dac9e013dd6197fb49d2b701 - SHA-1:
9202b83071047fd26cf606ffd020b8b139134194 - MD5:
cf1a20d3b24db664cd0aed678babebe8 - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 795520 bytes
- Verdict: malicious (98/100) · Family: Zusy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
2374 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/12745/files/5259779e9c56092e7c39dd8d3e78494d7ca527c77d758cb5074d165b9567d8b0 —
5259779e9c56092e7c39dd8d3e78494d7ca527c77d758cb5074d165b9567d8b0 - /opt/CAPEv2/storage/analyses/12745/files/f40454bc9bfe60827f6e2ea340ec97cdd2cec0fe118c63bf7bb71d7caba5da31 —
f40454bc9bfe60827f6e2ea340ec97cdd2cec0fe118c63bf7bb71d7caba5da31 - /opt/CAPEv2/storage/analyses/12745/files/029c8585092f45377a1ae9243600479682c2b6c30df5dc38b9fc3324ebeaa90d —
029c8585092f45377a1ae9243600479682c2b6c30df5dc38b9fc3324ebeaa90d - /opt/CAPEv2/storage/analyses/12745/files/ccf408748e395fb76faa7a619da10ce446b85fe4ac39a21e392d0f9b01b8cba8 —
ccf408748e395fb76faa7a619da10ce446b85fe4ac39a21e392d0f9b01b8cba8 - /opt/CAPEv2/storage/analyses/12745/files/d66a8f8634c568b71e99fb590cf02bfddff77381b28d9994b6d91c8aacf9ffa3 —
d66a8f8634c568b71e99fb590cf02bfddff77381b28d9994b6d91c8aacf9ffa3 - /opt/CAPEv2/storage/analyses/12745/files/6f6f36190a6ca7aed0529e2e6bc940d2bfe195b3152cb674230ac180a6de9bca —
6f6f36190a6ca7aed0529e2e6bc940d2bfe195b3152cb674230ac180a6de9bca - /opt/CAPEv2/storage/analyses/12745/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/12745/files/3a2fbf5c3f0f20add1875d427bd1b06e3c24c8a1c5a2573d8cde6886536dc563 —
3a2fbf5c3f0f20add1875d427bd1b06e3c24c8a1c5a2573d8cde6886536dc563 - /opt/CAPEv2/storage/analyses/12745/files/e5f50abc229a1dacef95fcb9014ce8feaf8dc8e7255683985c8e4ec46f6456fd —
e5f50abc229a1dacef95fcb9014ce8feaf8dc8e7255683985c8e4ec46f6456fd - /opt/CAPEv2/storage/analyses/12745/files/cd4332fb20deeb3c0caf472eb377c970718725aa84b24f79cf6a527987737f42 —
cd4332fb20deeb3c0caf472eb377c970718725aa84b24f79cf6a527987737f42 - /opt/CAPEv2/storage/analyses/12745/files/ca201fb5dff1517838f774beea31c5ed0503a57c2acd85c2a22b22e9a4ed1344 —
ca201fb5dff1517838f774beea31c5ed0503a57c2acd85c2a22b22e9a4ed1344 - /opt/CAPEv2/storage/analyses/12745/files/6849736d2185d3df6e1bbaaab6b1207c5da639657eefac1b19e8177360720366 —
6849736d2185d3df6e1bbaaab6b1207c5da639657eefac1b19e8177360720366 - /opt/CAPEv2/storage/analyses/12745/files/e0d0d10737cdaa9e78d0a453e691d1784aa7bf49c6b518d4db583919f3f05548 —
e0d0d10737cdaa9e78d0a453e691d1784aa7bf49c6b518d4db583919f3f05548 - /opt/CAPEv2/storage/analyses/12745/files/da5a871f2f3961356a250b249968ea67b1d052f5ea42270f05d58e45c9799e41 —
da5a871f2f3961356a250b249968ea67b1d052f5ea42270f05d58e45c9799e41 - /opt/CAPEv2/storage/analyses/12745/files/4096c44537daac7e24639831d122d917e7ed5371c8015df6845e1a16cfa923a5 —
4096c44537daac7e24639831d122d917e7ed5371c8015df6845e1a16cfa923a5
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786530349&P2=404&P3=2&P4=QubmX9nfYaSlBumjfz6i%2fOS2LLYO1PuP%2fJ8BfNxOMv52JJR7DCUShI%2bGByu1Y1PLV79LMCKRmN2BANFeak3gFQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786530379&P2=404&P3=2&P4=XIgIJRxkhKhxxofjL%2ftlt4hBP6LE0khZWpGeR9nDvbhZNJYj81Cc%2bKxt9AWlgC5j7XOvon2eSXP6eNpKI8utHQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- p.co
Embedded IP addresses
- 20.42.179.192
- 4.150.223.100
- 4.230.171.124
- 52.230.59.222
- 85.210.193.152
- 135.233.95.144
- 135.232.92.97
- 51.104.15.253
- 13.89.179.12
- 74.178.76.44
- 203.26.79.13
- 135.234.160.244
- 72.154.7.99
- 92.223.78.30
- 52.148.114.188
- 52.110.12.47
- 52.110.12.53
More Zusy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report