MALICIOUS — 252594fd406fc82862b7ce219fe1d05d5b6fa3dd183db9b5922c7008afd48f36
MALICIOUS — 252594fd406fc82862b7ce219fe1d05d5b6fa3dd183db9b5922c7008afd48f36 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
252594fd406fc82862b7ce219fe1d05d5b6fa3dd183db9b5922c7008afd48f36 - SHA-1:
033c452654bd0e43217bebe0fa160d911caaf42a - MD5:
d753ec8add1d12611c598775e942ec4e - imphash:
f1a539a5b71ad53ac586f053145f08ec - ssdeep:
12288:SudjYk7bwrdWqyawNImMGE93HlBasRPdxFkS6cVA1MQ7Lb/8Fe99qKSqfHFv:SudjYkNxWmMFlUeX76cCRL82qzqflv - TLSH:
T11451234E14AFAD7DF291D8DA394970DFAB1262472468F01F9AF09C17750C0AF84B9B12 - Submitted as: 252594fd406fc82862b7ce219fe1d05d5b6fa3dd183db9b5922c7008afd48f36
- File type: pe · Size: 877952 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule
Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule
Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule
Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule
Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85 - Contacted 39 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
2357 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13657/files/4fbf8a0de40b09380b02846ed605cda7c305ebd8b85c423a9072a5ed757f954e -
4fbf8a0de40b09380b02846ed605cda7c305ebd8b85c423a9072a5ed757f954e - /opt/CAPEv2/storage/analyses/13657/files/099bf5f3a4a37a846f83bc8fe18ac1cfe65c3ab1891222966006691383c2d7cf -
099bf5f3a4a37a846f83bc8fe18ac1cfe65c3ab1891222966006691383c2d7cf - /opt/CAPEv2/storage/analyses/13657/files/dfd88e034a42bb0a2ca97b4dc18c48a351e5cc60560c9c80529ded22b9d74c8d -
dfd88e034a42bb0a2ca97b4dc18c48a351e5cc60560c9c80529ded22b9d74c8d - /opt/CAPEv2/storage/analyses/13657/files/e8932865c104d7a69536d59c0067a528bcd51cb206c2e4f459bf51ee4e6198ce -
e8932865c104d7a69536d59c0067a528bcd51cb206c2e4f459bf51ee4e6198ce - /opt/CAPEv2/storage/analyses/13657/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 -
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13657/files/33968bfe04058a7520df7fc253b93a4f16413a9d35b0f7cea4393802b0dc3455 -
33968bfe04058a7520df7fc253b93a4f16413a9d35b0f7cea4393802b0dc3455 - /opt/CAPEv2/storage/analyses/13657/files/df615d0cbee7d94fe10a54f472fb6f94f7e622bb09f9edfe6952575b6ea13cf0 -
df615d0cbee7d94fe10a54f472fb6f94f7e622bb09f9edfe6952575b6ea13cf0 - /opt/CAPEv2/storage/analyses/13657/files/b2f07a5c302fb4f7b3bb78c8c045ba556b321de7a09a5f523aa53841472e43d8 -
b2f07a5c302fb4f7b3bb78c8c045ba556b321de7a09a5f523aa53841472e43d8 - /opt/CAPEv2/storage/analyses/13657/files/541940013a0964f47f905f5b7931e0e19a728cefeda83ee876b06935a6a1ea4e -
541940013a0964f47f905f5b7931e0e19a728cefeda83ee876b06935a6a1ea4e - /opt/CAPEv2/storage/analyses/13657/files/71529580cb6354429330c5da5a20d51a70797bdb4cd0962caa801b3f05e2b39a -
71529580cb6354429330c5da5a20d51a70797bdb4cd0962caa801b3f05e2b39a - /opt/CAPEv2/storage/analyses/13657/files/829fa8e36b294269a6d6e5a4913e2840f8b005748fb68a14922bf17db9e840a8 -
829fa8e36b294269a6d6e5a4913e2840f8b005748fb68a14922bf17db9e840a8 - /opt/CAPEv2/storage/analyses/13657/files/3993fe019d102250a7057ce34a776003bad410fd5868e030a4687a2061333fa4 -
3993fe019d102250a7057ce34a776003bad410fd5868e030a4687a2061333fa4 - /opt/CAPEv2/storage/analyses/13657/files/20525a044c14a472eaddeae387bffeb94a164ec743940400ea3c1e9cf4f01cde -
20525a044c14a472eaddeae387bffeb94a164ec743940400ea3c1e9cf4f01cde - /opt/CAPEv2/storage/analyses/13657/files/139245e01f6d0f286fbf07f4bc752166a3a54597b241a8c1168052d1a7d8c365 -
139245e01f6d0f286fbf07f4bc752166a3a54597b241a8c1168052d1a7d8c365 - /opt/CAPEv2/storage/analyses/13657/files/7323a6b2e22f887db9a51b01b7b3a6c3d4d8a2d60f8ee6d46986c8bc97e5a894 -
7323a6b2e22f887db9a51b01b7b3a6c3d4d8a2d60f8ee6d46986c8bc97e5a894
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786553532&P2=404&P3=2&P4=H%2b5G0zAIE1TisjgZue6fImdsvNsmD%2fvDU%2bIZgOTQJWqnqbPuHyS7V2ruuOTDAa7LuUoQYfRNlVAS9njHejLfjQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786553561&P2=404&P3=2&P4=SKBxWi0n6RJe1H3X%2fb3w%2b080jQp8aoALwQZadbap517DHedk1PFn99TZ%2fJGlV1m3XkviMhzR4igPu9cxhqZiiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.42.65.91
- 4.230.171.124
- 20.247.184.197
- 85.210.196.11
- 57.155.104.224
- 135.233.95.144
- 74.178.76.54
- 20.184.175.0
- 135.232.92.137
- 4.150.223.112
- 20.184.175.11
- 172.178.240.163
- 92.223.78.30
- 203.26.79.13
- 52.123.252.233
- 74.178.76.44
- 4.247.188.233
- 52.110.12.1
- 52.110.12.5
- 72.154.7.103
- 52.148.114.188
- 52.110.12.15
- 52.110.12.22
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report