MALICIOUS — 595d720fc3e30785465107fc47d7e8148c1aa603512b4997d97f5fab2b71e8c4
MALICIOUS — 595d720fc3e30785465107fc47d7e8148c1aa603512b4997d97f5fab2b71e8c4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
595d720fc3e30785465107fc47d7e8148c1aa603512b4997d97f5fab2b71e8c4 - SHA-1:
91b5cdda7bc0a8dbdd50f05c1f00bfbec8005c3f - MD5:
471c8af126dc2335068efdd8eee9c34c - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 83880 bytes
- Verdict: malicious (98/100) · Family: Zusy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
2355 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- licensing.mp.microsoft.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13009/files/bfa16cbadbaa645be53c128d343528da5662fc250eaea23d057083d4fb824e05 —
bfa16cbadbaa645be53c128d343528da5662fc250eaea23d057083d4fb824e05 - /opt/CAPEv2/storage/analyses/13009/files/392b1381062a84ce8a1b45f4e5273477c25e57e00ab3385bc19db95200dd7f20 —
392b1381062a84ce8a1b45f4e5273477c25e57e00ab3385bc19db95200dd7f20 - /opt/CAPEv2/storage/analyses/13009/files/5c2e8b85dded08a3658d4737196ca2149492c1cb4e4996e448dc4a52d7d8d0fb —
5c2e8b85dded08a3658d4737196ca2149492c1cb4e4996e448dc4a52d7d8d0fb - /opt/CAPEv2/storage/analyses/13009/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13009/files/50fae2cdc3f426952f760e0188906047244b2f4cc0bc25a1f29b5dfbd2db2efa —
50fae2cdc3f426952f760e0188906047244b2f4cc0bc25a1f29b5dfbd2db2efa - /opt/CAPEv2/storage/analyses/13009/files/97453be8289a2e48d5a02beedd567d1ea329630a6e619458eaa130a42403fe5f —
97453be8289a2e48d5a02beedd567d1ea329630a6e619458eaa130a42403fe5f - /opt/CAPEv2/storage/analyses/13009/files/1e14d83aed0c2c88b0957f94ca6c3e4f64810ee84c8359b28149ed6b8d3820b3 —
1e14d83aed0c2c88b0957f94ca6c3e4f64810ee84c8359b28149ed6b8d3820b3 - /opt/CAPEv2/storage/analyses/13009/files/94f9c9369a7876cba935adaf87f9b99724dc1a9574ba5152fb214fd616d58770 —
94f9c9369a7876cba935adaf87f9b99724dc1a9574ba5152fb214fd616d58770 - /opt/CAPEv2/storage/analyses/13009/files/5224f3b5a8a9735e6e31ccc3c19309836fd53d08a92b1eb82be5e2aeb0eaa16c —
5224f3b5a8a9735e6e31ccc3c19309836fd53d08a92b1eb82be5e2aeb0eaa16c - /opt/CAPEv2/storage/analyses/13009/files/453d5906e0ff2372205f95df0bfb5be6f34160557e42ffaa948f5a9fa8d15549 —
453d5906e0ff2372205f95df0bfb5be6f34160557e42ffaa948f5a9fa8d15549 - /opt/CAPEv2/storage/analyses/13009/files/63ba8a60edde68ce1396112274ff2886d114a4319c83d4025f439cff826b450e —
63ba8a60edde68ce1396112274ff2886d114a4319c83d4025f439cff826b450e - /opt/CAPEv2/storage/analyses/13009/files/bfeffea47af8ed6f863a66f7fb434acec83be9bc4a5bf100a9a704dc8ec0bd59 —
bfeffea47af8ed6f863a66f7fb434acec83be9bc4a5bf100a9a704dc8ec0bd59 - /opt/CAPEv2/storage/analyses/13009/files/3dccf0cc2c5051b3a843a1fe1a4bfdf08de1685f41447a6d7dfc2ea382969476 —
3dccf0cc2c5051b3a843a1fe1a4bfdf08de1685f41447a6d7dfc2ea382969476 - /opt/CAPEv2/storage/analyses/13009/files/d80d5102e7640e2527bc5afcfd1c4a30ff524ff2001f66f161864f87742ddd3e —
d80d5102e7640e2527bc5afcfd1c4a30ff524ff2001f66f161864f87742ddd3e - /opt/CAPEv2/storage/analyses/13009/files/9d4ec5e0383baca938a105d215216eae94c7936a1379bd23332b89d7e65ed33c —
9d4ec5e0383baca938a105d215216eae94c7936a1379bd23332b89d7e65ed33c
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786536994&P2=404&P3=2&P4=Ri8UrYSoOEg8F7KHQzkR6EY19miCR4BuDe%2fwZYj1ElCTPVNqvSAltFtbtLGerMclZ9sLQGsci5tsTOxi%2fR4Jdg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786537019&P2=404&P3=2&P4=JDjbJluLDodr717JHwf0%2fofuxdI2T7AHHiw4usI0tOv5EoBSSsLgQQlAZ3P8HyHcPZBcJHbCBVAb1%2fw8fG8xcQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 4.150.223.106
- 52.123.252.227
- 20.247.184.197
- 85.210.193.152
- 4.230.171.124
- 74.179.77.204
- 104.46.162.230
- 74.178.240.51
- 135.232.92.137
- 48.211.4.16
- 172.178.240.162
- 52.123.252.198
- 135.232.92.34
- 203.26.79.13
- 52.148.114.188
- 72.145.35.105
- 52.110.12.30
- 52.110.12.55
More Zusy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report