MALICIOUS — 58034eb8e4b2b971870038510bae21151999228c7ef14fc2346e547052ffed34

MALICIOUS — 58034eb8e4b2b971870038510bae21151999228c7ef14fc2346e547052ffed34 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 58034eb8e4b2b971870038510bae21151999228c7ef14fc2346e547052ffed34
SHA-1: a47b9414da0747367bc132f51983b065e6768ce2
MD5: 4adcc8e4aba7e348f4e7b3f6e04725a3
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 24576:Sb5ndn2GJC5rpWxSJFP1YVMVYrGLh+Xyz7:STRJAVFPvVYiL+yf
TLSH: T1395233357F3FFB4BE4DA9C6DE811269DC21621A244FE2CBDB7900506F2D2A536E04981
Submitted as: 58034eb8e4b2b971870038510bae21151999228c7ef14fc2346e547052ffed34
File type: pe · Size: 988032 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Dropped a suspicious payload (Container): 1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4 - dynamic signal, weight 0.50, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 43 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

49652 behavior events · 2 ATT&CK techniques · 33 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13644/files/1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4 - 1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4
/opt/CAPEv2/storage/analyses/13644/files/7375f83e71c482737271c90b0e196e3edcc74afdc9f0208421d578edd3c89a39 - 7375f83e71c482737271c90b0e196e3edcc74afdc9f0208421d578edd3c89a39
/opt/CAPEv2/storage/analyses/13644/files/f7a22a5e099639a9dd64c595fd13d4ecae81f4cce1f33dbf49622091ed7c2f4b - f7a22a5e099639a9dd64c595fd13d4ecae81f4cce1f33dbf49622091ed7c2f4b
/opt/CAPEv2/storage/analyses/13644/files/be2959e64db08734e89357a9e5d9986cf4051c27bee6c78fe9d52b0353ac13e8 - be2959e64db08734e89357a9e5d9986cf4051c27bee6c78fe9d52b0353ac13e8
/opt/CAPEv2/storage/analyses/13644/files/fcdee7255fdcfc07eebe775f4f102ea8b89c1cc3cfc31e378fcace4da313a975 - fcdee7255fdcfc07eebe775f4f102ea8b89c1cc3cfc31e378fcace4da313a975
/opt/CAPEv2/storage/analyses/13644/files/d2ec732cfb4f249afded08dd7ec47a28312d29adb34620c8fd355cd361b4ddd2 - d2ec732cfb4f249afded08dd7ec47a28312d29adb34620c8fd355cd361b4ddd2
/opt/CAPEv2/storage/analyses/13644/files/f3d76fa3a78960e4156227512b1c90c0e7a1d311f2c354f6efe9304c0eb2fe26 - f3d76fa3a78960e4156227512b1c90c0e7a1d311f2c354f6efe9304c0eb2fe26
/opt/CAPEv2/storage/analyses/13644/files/d53036502b6fb1966785df934ecda5782ef0290501c7806e2ab7bded1cec3429 - d53036502b6fb1966785df934ecda5782ef0290501c7806e2ab7bded1cec3429
/opt/CAPEv2/storage/analyses/13644/files/ec01714934b7c8b573a0193affc92890ffe8dc96b87b4fe2cafe17061d836651 - ec01714934b7c8b573a0193affc92890ffe8dc96b87b4fe2cafe17061d836651
/opt/CAPEv2/storage/analyses/13644/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13644/files/fd31ae751d39b1fb8bc7ff970db741824043212b569a92796c4e207f15ad4e6b - fd31ae751d39b1fb8bc7ff970db741824043212b569a92796c4e207f15ad4e6b
/opt/CAPEv2/storage/analyses/13644/files/c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6 - c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6
/opt/CAPEv2/storage/analyses/13644/files/62893ce0af5943762eda88346fe25805e99d567e289e16d72f40adaee5a98dd6 - 62893ce0af5943762eda88346fe25805e99d567e289e16d72f40adaee5a98dd6
/opt/CAPEv2/storage/analyses/13644/files/051b45b316501c5342b7b37d7766b9f15211cda98825130c2eab93a748cbd04b - 051b45b316501c5342b7b37d7766b9f15211cda98825130c2eab93a748cbd04b
/opt/CAPEv2/storage/analyses/13644/files/e7d4b56f22caee9b0b35de5de681dae1a7402b23a99010638ab86652c00b9a01 - e7d4b56f22caee9b0b35de5de681dae1a7402b23a99010638ab86652c00b9a01

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786553127&P2=404&P3=2&P4=MoG%2bB6RjYlYLHSi%2bVLQUwTiD1El6zdbZggji6mSyiBEtSOL2%2bIy7qBZBc6l%2bz0iw%2fq2dQc6l2vG02lyAvCTQlA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786553166&P2=404&P3=2&P4=l0iJnCa5hprbeLkCyn%2f5X2mDKwWp3yjrF4n8HHH0ivkX8336WXXDBTnCfFiug3OxbnikCEmfnCS11Lr4lGFGSw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded IP addresses

52.110.12.21
52.110.12.48
20.184.175.9
52.123.252.225
4.230.171.124
4.247.188.224
20.247.185.124
74.178.76.128
135.232.92.97
52.168.117.175
203.26.79.13
52.123.252.223
20.165.94.46
52.123.252.219
172.178.240.162
20.89.1.8
135.234.160.244
135.233.45.221
72.145.35.98
20.184.175.3
104.208.16.94
52.148.114.188
142.250.195.227
52.110.12.46
52.110.12.33

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report