MALICIOUS — 548fe68c51a595211258b647269012bbdf0cae1fb9a588734c093e2164aca937

MALICIOUS — 548fe68c51a595211258b647269012bbdf0cae1fb9a588734c093e2164aca937 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 548fe68c51a595211258b647269012bbdf0cae1fb9a588734c093e2164aca937
• SHA-1: 437d6958bdaa67e6c266cff052a01e67f47b3af3
• MD5: c3e61f413109a0dbdf4380c8f153fb3c
• imphash: f1a539a5b71ad53ac586f053145f08ec
• File type: pe · Size: 3560872 bytes
• Verdict: malicious (100/100) · Family: Zusy

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Zusy-9957983-0
• Detect It Easy (packer/type): DIE:UPX
• Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
• Microsoft Defender: Trojan:Win32/Prepscram!pz
• Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Dynamic analysis (windows)

6662 behavior events · 2 ATT&CK techniques · 25 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• settings-win.data.microsoft.com
• officeclient.microsoft.com
• licensing.mp.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• tas02.sls.update.microsoft.com
• fe3cr.delivery.mp.microsoft.com
• slscr.update.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/12781/files/e3f54465dbf6e43ddcf4ae9651d2344f8f168d87b6d1e8da42f328585d6574df — e3f54465dbf6e43ddcf4ae9651d2344f8f168d87b6d1e8da42f328585d6574df
• /opt/CAPEv2/storage/analyses/12781/files/a1f2d6f97d160398894dad93fc61aee17a7db74e3a57c6b708b9e24eddec9320 — a1f2d6f97d160398894dad93fc61aee17a7db74e3a57c6b708b9e24eddec9320
• /opt/CAPEv2/storage/analyses/12781/files/7f66815f5bdafcb8e058d990beab3bbd638188a10d34cce4695327eea1750525 — 7f66815f5bdafcb8e058d990beab3bbd638188a10d34cce4695327eea1750525
• /opt/CAPEv2/storage/analyses/12781/files/01e7c02a5c75a922c57c531a6e1a864eaeef38c73335b3a37bdfd114beb87ef5 — 01e7c02a5c75a922c57c531a6e1a864eaeef38c73335b3a37bdfd114beb87ef5
• /opt/CAPEv2/storage/analyses/12781/files/4a36af487dfaf554c9bfc3c743934ccd857feed695d3312906960f34ef2b3d24 — 4a36af487dfaf554c9bfc3c743934ccd857feed695d3312906960f34ef2b3d24
• /opt/CAPEv2/storage/analyses/12781/files/d343e2045f292ef822977885362c8a58af4ac08cb1e81ad99d15862f0cf90b48 — d343e2045f292ef822977885362c8a58af4ac08cb1e81ad99d15862f0cf90b48
• /opt/CAPEv2/storage/analyses/12781/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 — b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
• /opt/CAPEv2/storage/analyses/12781/files/3e34ea4f9b69cdbedbc3675a5322a0f6b6adbb31d14eed5e3698a5320c0b1b2b — 3e34ea4f9b69cdbedbc3675a5322a0f6b6adbb31d14eed5e3698a5320c0b1b2b
• /opt/CAPEv2/storage/analyses/12781/files/c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6 — c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6
• /opt/CAPEv2/storage/analyses/12781/files/842d60d4cc6046642983fd639c91d7a20519cd2ff8ec18a0ace3bc82aded1f20 — 842d60d4cc6046642983fd639c91d7a20519cd2ff8ec18a0ace3bc82aded1f20
• /opt/CAPEv2/storage/analyses/12781/files/1d2260be23de3501d826f728518f31266c8491dd44762dbbbfed289186cd3479 — 1d2260be23de3501d826f728518f31266c8491dd44762dbbbfed289186cd3479
• /opt/CAPEv2/storage/analyses/12781/files/20b9f63195f7d010d757d26a8fa9c99b027a4fd98b7ff15bc769b119230e756a — 20b9f63195f7d010d757d26a8fa9c99b027a4fd98b7ff15bc769b119230e756a
• /opt/CAPEv2/storage/analyses/12781/files/4a65dd85d25db89dce2dc77d091e693a3c9582b7acaa0318e5d09bdff6f66344 — 4a65dd85d25db89dce2dc77d091e693a3c9582b7acaa0318e5d09bdff6f66344
• /opt/CAPEv2/storage/analyses/12781/files/da2c95e1def1b155041995d45cfb6bf17d31252f1df23d928997fde619d220f7 — da2c95e1def1b155041995d45cfb6bf17d31252f1df23d928997fde619d220f7
• /opt/CAPEv2/storage/analyses/12781/files/5daaa4e4d3834283c853eacb6eed77bcf54ba773119df6f605a6ccba89c90065 — 5daaa4e4d3834283c853eacb6eed77bcf54ba773119df6f605a6ccba89c90065

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786531302&P2=404&P3=2&P4=k7dKByVaf2yEi6o%2bIQrUpFC1X%2fj82ZXAM%2fsM3Ya6u1c8UX4niWLVsGP5pBi%2bIzqV3dJz8C4P2tOJbeI%2bOrJmZw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786531401&P2=404&P3=2&P4=b9A9hSsSkYaHuqfjOyV448RrkopJxJgx%2fLtzVeuJZ5ZS8rIcoOwBcSVeiQxxt0zC8IQ8Rv3O1DN3n6ebaa3P2w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

• 4.150.223.104
• 20.247.185.124
• 172.215.188.232
• 4.230.171.124
• 20.165.94.63
• 20.165.94.54
• 13.69.116.105
• 20.42.179.204
• 135.233.45.223
• 20.42.65.85
• 203.26.79.13
• 135.234.160.246
• 74.179.71.159
• 72.154.7.111
• 52.148.114.188
• 52.110.12.42
• 52.110.12.20

File paths

• a:\[
• h:\8}e

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report