MALICIOUS — c613c623b196bbe60597df0d50ce1c385c526549ae57516ef9dd7aeb325260d6
MALICIOUS — c613c623b196bbe60597df0d50ce1c385c526549ae57516ef9dd7aeb325260d6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
c613c623b196bbe60597df0d50ce1c385c526549ae57516ef9dd7aeb325260d6 - SHA-1:
f3375976e8b523c97baf932f836ff03c64299f7d - MD5:
2e2c035cf6c5dd373cdbb716044b194a - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 795520 bytes
- Verdict: malicious (98/100) · Family: Zusy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
2355 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13147/files/3edcae5f7fcc2c5687136635546140a8a7022efe094e65160b2b8ef33a1517bd —
3edcae5f7fcc2c5687136635546140a8a7022efe094e65160b2b8ef33a1517bd - /opt/CAPEv2/storage/analyses/13147/files/9def1b8b4556f3c53685e166b96230e0cb12b8edcc517257d7bfa1c96987c54c —
9def1b8b4556f3c53685e166b96230e0cb12b8edcc517257d7bfa1c96987c54c - /opt/CAPEv2/storage/analyses/13147/files/3f6a337858c31dde557694ebaa66932df044dff5ffed9edcb92ba8b26e18855d —
3f6a337858c31dde557694ebaa66932df044dff5ffed9edcb92ba8b26e18855d - /opt/CAPEv2/storage/analyses/13147/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13147/files/5912f013fc552227cb9beae667e71ac51a5422aeae59283500d79a03f872575f —
5912f013fc552227cb9beae667e71ac51a5422aeae59283500d79a03f872575f - /opt/CAPEv2/storage/analyses/13147/files/a045fd09222bc683ab40439f533462099ca1ffc2247418eda979cf17ff414acb —
a045fd09222bc683ab40439f533462099ca1ffc2247418eda979cf17ff414acb - /opt/CAPEv2/storage/analyses/13147/files/2e5a76769886a587ea5067cfcee2d792dada3b4f2b1f0c050d250ee1a9a3c063 —
2e5a76769886a587ea5067cfcee2d792dada3b4f2b1f0c050d250ee1a9a3c063 - /opt/CAPEv2/storage/analyses/13147/files/a16b3b2cd7709dd8506c2b021293066833d4d5c49604ce8a325bfa4af69c2729 —
a16b3b2cd7709dd8506c2b021293066833d4d5c49604ce8a325bfa4af69c2729 - /opt/CAPEv2/storage/analyses/13147/files/46242121395c4d753e4d1384e5acaf1e945c4944f29cf387e303c5cfffe6e705 —
46242121395c4d753e4d1384e5acaf1e945c4944f29cf387e303c5cfffe6e705 - /opt/CAPEv2/storage/analyses/13147/files/df4336dda523b572ca8dc70c8e661bac49cbd9c5afcf59f79c6b4583919f17d7 —
df4336dda523b572ca8dc70c8e661bac49cbd9c5afcf59f79c6b4583919f17d7 - /opt/CAPEv2/storage/analyses/13147/files/c0f60b4bb682068353d31d8e5125651667d589cc6beee091678188bf931e6aa1 —
c0f60b4bb682068353d31d8e5125651667d589cc6beee091678188bf931e6aa1 - /opt/CAPEv2/storage/analyses/13147/files/8d7dadadbee71c8b1b2fd88b157592934041d9e132effb1d315199bdd1f58d92 —
8d7dadadbee71c8b1b2fd88b157592934041d9e132effb1d315199bdd1f58d92 - /opt/CAPEv2/storage/analyses/13147/files/8b4fc7c42088102a49466117e68eb62da6eb90e5d52f8b3ac79db6df2a12742f —
8b4fc7c42088102a49466117e68eb62da6eb90e5d52f8b3ac79db6df2a12742f - /opt/CAPEv2/storage/analyses/13147/files/f1c5b20be843903992fc9eb75d66b31fa4891d3f4105830fc715b212ff2d0ce5 —
f1c5b20be843903992fc9eb75d66b31fa4891d3f4105830fc715b212ff2d0ce5 - /opt/CAPEv2/storage/analyses/13147/files/3d0ee270a5f8bd77edd625c6c85c3a32b849ff780db2bdb64bf11042c5929bee —
3d0ee270a5f8bd77edd625c6c85c3a32b849ff780db2bdb64bf11042c5929bee
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786540423&P2=404&P3=2&P4=Ipc%2fb7MyDRV8yg8B6Oy9vwvnRzzXrOfytp%2fpzKAOLetKkQtHY5TkJTcCDzBg0AnStsShKE0HKLTfyzvASuqXsw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786540469&P2=404&P3=2&P4=REgm1pZIHykckdOn7dSAKZy%2bPBrBzFeNCvsUtEoNB0FpjdjhcbP3reev1RD2h0eDH9NY%2b7%2bMqkikR1UiFv9ANg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 74.178.76.44
- 4.150.223.115
- 52.123.252.198
- 20.247.185.124
- 20.42.179.192
- 4.230.171.124
- 74.178.240.61
- 135.233.95.135
- 20.42.65.91
- 135.233.45.222
- 52.110.12.4
- 52.110.12.42
- 203.26.79.13
- 74.178.232.29
- 72.145.35.108
- 52.148.114.188
- 92.223.78.30
- 52.110.12.38
- 52.110.12.55
More Zusy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report