MALICIOUS — e2b2b24470a89db2711be5f5326cc27fafe02a52d852bad19a6b0bb852107704
MALICIOUS — e2b2b24470a89db2711be5f5326cc27fafe02a52d852bad19a6b0bb852107704 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Zusy family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
e2b2b24470a89db2711be5f5326cc27fafe02a52d852bad19a6b0bb852107704 - SHA-1:
91bd34d5aaee46b4020f96384748e6c60d377eb3 - MD5:
ac32bb71862115a22a7a45eabc36891d - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 795520 bytes
- Verdict: malicious (98/100) · Family: Zusy
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
MITRE ATT&CK
Dynamic analysis (windows)
2358 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13233/files/49de2457b92526ac3079699f8ccc8e43b5ed4e1cc6933516ba08b03c2658d2c8 —
49de2457b92526ac3079699f8ccc8e43b5ed4e1cc6933516ba08b03c2658d2c8 - /opt/CAPEv2/storage/analyses/13233/files/456dec037c99bc4f322170521a1c348c25d90583dfc96b503436c764daeccd06 —
456dec037c99bc4f322170521a1c348c25d90583dfc96b503436c764daeccd06 - /opt/CAPEv2/storage/analyses/13233/files/c6e9a260abac645802956108709651d224618afa70626a1c22f5371648cf5eb8 —
c6e9a260abac645802956108709651d224618afa70626a1c22f5371648cf5eb8 - /opt/CAPEv2/storage/analyses/13233/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13233/files/64b47cdfe52d9d62b3592723fde910beea781a246715f99ad1236bcb50667e37 —
64b47cdfe52d9d62b3592723fde910beea781a246715f99ad1236bcb50667e37 - /opt/CAPEv2/storage/analyses/13233/files/b7e78de8bac86d4e2e9b22ded886a249fd7639632168599d3c833b43f396121e —
b7e78de8bac86d4e2e9b22ded886a249fd7639632168599d3c833b43f396121e - /opt/CAPEv2/storage/analyses/13233/files/7acd2b2203789767f7594d7fa18ec093a4219aa835213cd66a8d0748b096c1bc —
7acd2b2203789767f7594d7fa18ec093a4219aa835213cd66a8d0748b096c1bc - /opt/CAPEv2/storage/analyses/13233/files/3c3744793928d7e0286b2fd3b8b1f3b98176d3540ed6180dae1cf76f9ec03cf0 —
3c3744793928d7e0286b2fd3b8b1f3b98176d3540ed6180dae1cf76f9ec03cf0 - /opt/CAPEv2/storage/analyses/13233/files/25171ca1e5dd5cafe18dca6f8856efaab3c26119d50db6885a3480f232064b15 —
25171ca1e5dd5cafe18dca6f8856efaab3c26119d50db6885a3480f232064b15 - /opt/CAPEv2/storage/analyses/13233/files/2bcd8a699ae594c4788f33ab52d69e77223b249f094df58cf44631584f6af88f —
2bcd8a699ae594c4788f33ab52d69e77223b249f094df58cf44631584f6af88f - /opt/CAPEv2/storage/analyses/13233/files/191a928023047a3def45fe7e2b365a954509a046dd5ec725c0a94d92422f699f —
191a928023047a3def45fe7e2b365a954509a046dd5ec725c0a94d92422f699f - /opt/CAPEv2/storage/analyses/13233/files/21c6b23278bedc5de71fe9612e97df08f0ff4f5eab6ab79cd6b1b0ebf88c6ecc —
21c6b23278bedc5de71fe9612e97df08f0ff4f5eab6ab79cd6b1b0ebf88c6ecc - /opt/CAPEv2/storage/analyses/13233/files/1a71f5559ab7ae8e281b2fd0b9d300a29f5fa472cd14ca6f0540e9b95a892c0e —
1a71f5559ab7ae8e281b2fd0b9d300a29f5fa472cd14ca6f0540e9b95a892c0e - /opt/CAPEv2/storage/analyses/13233/files/8c0c603895b06757706e8ab0f13b2f8f839c8e6768c0645ac6b09402d6406231 —
8c0c603895b06757706e8ab0f13b2f8f839c8e6768c0645ac6b09402d6406231 - /opt/CAPEv2/storage/analyses/13233/files/b8e66c994b2908bb0bea71c039bfb4e36ad3110b01b5b08a64d3a0f7a1973024 —
b8e66c994b2908bb0bea71c039bfb4e36ad3110b01b5b08a64d3a0f7a1973024
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786542578&P2=404&P3=2&P4=Y8Snpt2tAqbFvQ5dvmZ1qJ%2f4%2fZGY5JUKiC4K7Bkx5rF5RhX0Kn0%2ba6V65uc89gK96jo%2bb9LNCVZ0FuP8KdzymA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786542597&P2=404&P3=2&P4=moPolgdC1cfnyQNEbBiEhtG72bSbI4Z4XLddOz1%2byALKFHqEU1Ndc1neY4C4XZLuo%2fZJled577oiVbLGvAVVlw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- c2.it
Embedded IP addresses
- 57.155.101.212
- 4.150.223.99
- 52.123.252.236
- 52.230.59.222
- 4.230.171.124
- 135.233.95.144
- 74.179.77.164
- 104.208.16.94
- 135.232.92.34
- 203.26.79.13
- 135.233.45.223
- 92.223.78.30
- 52.110.12.38
- 52.110.12.14
- 72.154.7.106
- 52.123.252.243
- 52.110.12.37
- 52.110.12.44
- 52.148.114.188
File paths
- I:\h1
More Zusy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report