MALICIOUS — ceae2df4ae1287dffdab393182f9527d2393f8d836be348a3f3c6d7c349aac3f

MALICIOUS — ceae2df4ae1287dffdab393182f9527d2393f8d836be348a3f3c6d7c349aac3f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: ceae2df4ae1287dffdab393182f9527d2393f8d836be348a3f3c6d7c349aac3f
• SHA-1: f18841efbdcab95b4c27a8a22b4e290bf2831c85
• MD5: 62475fe5ecd32a4d99ced7a37d4c6684
• imphash: f1a539a5b71ad53ac586f053145f08ec
• File type: pe · Size: 2415528 bytes
• Verdict: malicious (98/100) · Family: Zusy

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Zusy-9957983-0
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: Trojan:Win32/Prepscram!pz
• Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
• Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

• T1112
• T1105

Dynamic analysis (windows)

2379 behavior events · 1 ATT&CK techniques · 17 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• licensing.mp.microsoft.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com
• settings-win.data.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• aefd.nelreports.net
• tas02.sls.update.microsoft.com
• msedge.api.cdp.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/13125/files/c48a541af3591f44a36a41d799361f4ac1abba534632672c1a3e03d259f2d385 — c48a541af3591f44a36a41d799361f4ac1abba534632672c1a3e03d259f2d385
• /opt/CAPEv2/storage/analyses/13125/files/c539649fc7bf53b94dca1eeb92ad2de9fe549d4f5c74e91994fcb9add6249fb0 — c539649fc7bf53b94dca1eeb92ad2de9fe549d4f5c74e91994fcb9add6249fb0
• /opt/CAPEv2/storage/analyses/13125/files/e303a266d0c77f8380164553de08d4eb02454f87ac21a6a208ff2e56204366e4 — e303a266d0c77f8380164553de08d4eb02454f87ac21a6a208ff2e56204366e4
• /opt/CAPEv2/storage/analyses/13125/files/d8a112f61bb41fe1122575f14a731c75e04eae8479a5344ada5101e877c3b72a — d8a112f61bb41fe1122575f14a731c75e04eae8479a5344ada5101e877c3b72a
• /opt/CAPEv2/storage/analyses/13125/files/f9ca9e7c7bca7b7469b55487cec4cab5abf4342c65d85801e003a3643b1a0a73 — f9ca9e7c7bca7b7469b55487cec4cab5abf4342c65d85801e003a3643b1a0a73
• /opt/CAPEv2/storage/analyses/13125/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 — b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
• /opt/CAPEv2/storage/analyses/13125/files/4c09b525307b8ad72e501856ff11fb6bbe6de2c08f9b5e5605e5bc5f0fe05340 — 4c09b525307b8ad72e501856ff11fb6bbe6de2c08f9b5e5605e5bc5f0fe05340
• /opt/CAPEv2/storage/analyses/13125/files/954752bbe138b35fcfb1613a4ab9354e7f9b33e13875a90b984d4d7491978990 — 954752bbe138b35fcfb1613a4ab9354e7f9b33e13875a90b984d4d7491978990
• /opt/CAPEv2/storage/analyses/13125/files/e4717958ef7b86c7ab13a2807fa957016ef00b5d6bc2aed03ffd410d16249d5e — e4717958ef7b86c7ab13a2807fa957016ef00b5d6bc2aed03ffd410d16249d5e
• /opt/CAPEv2/storage/analyses/13125/files/6d9d6fb3af204412797ac6ac06d543e7ae7706281bb9e404e540c7fd1e209240 — 6d9d6fb3af204412797ac6ac06d543e7ae7706281bb9e404e540c7fd1e209240
• /opt/CAPEv2/storage/analyses/13125/files/96abbb44f1d9f37a13b4da37cb378fdd2034b571be44abc9d0298ba934299adc — 96abbb44f1d9f37a13b4da37cb378fdd2034b571be44abc9d0298ba934299adc
• /opt/CAPEv2/storage/analyses/13125/files/ff26f6dc160ee49175d3663b0724e31c31b12fcd565155d406365e9d8cce262b — ff26f6dc160ee49175d3663b0724e31c31b12fcd565155d406365e9d8cce262b
• /opt/CAPEv2/storage/analyses/13125/files/b4542026096487809938b838f90da9b150f7a6ca5805549c83c26a77927134a4 — b4542026096487809938b838f90da9b150f7a6ca5805549c83c26a77927134a4
• /opt/CAPEv2/storage/analyses/13125/files/56787c227ef8aafa5865b6898f1c229f693038ba83f2d6ac624c04bf97da2947 — 56787c227ef8aafa5865b6898f1c229f693038ba83f2d6ac624c04bf97da2947
• /opt/CAPEv2/storage/analyses/13125/files/dc53c9763f1633d270cf2159c7d22de7951fa7916978f25e1d47c2bf542ed46c — dc53c9763f1633d270cf2159c7d22de7951fa7916978f25e1d47c2bf542ed46c

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786539889&P2=404&P3=2&P4=TnkrgTxOWBHywZM275qB0uwK1ThEJoAmuGiShuobY7HViWDnHMRu8pVLgd%2fq%2flP3V64af5vaRVtltOQa94I8gg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786539932&P2=404&P3=2&P4=Apk%2bYNYAfmAaBTpbBMT635gbEf7W6keDfDzFN67nuZ5%2bJ0b6BbNYlhXAXUz3SK0NqgADJEbk1Ai287ZNuNGsOQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• a.it
• c.se
• j.ch
• aefd.nelreports.net

Embedded IP addresses

• 20.184.175.17
• 52.123.252.247
• 20.247.184.142
• 40.84.85.40
• 4.230.171.124
• 57.155.104.224
• 74.179.77.204
• 135.232.92.97
• 4.150.223.102
• 4.150.223.106
• 203.26.79.13
• 135.234.160.246
• 20.165.94.46
• 92.223.78.30
• 40.84.97.4
• 20.42.73.28
• 51.11.192.50
• 172.66.2.5
• 52.110.12.16
• 52.110.12.51
• 72.153.5.132
• 52.148.114.188
• 52.110.12.50
• 52.110.12.21

File paths

• L:\/c

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report