MALICIOUS — 620dc39c2bd18717710fd81690690b543b3e536865d37849dcce8a504ab42bd1

MALICIOUS — 620dc39c2bd18717710fd81690690b543b3e536865d37849dcce8a504ab42bd1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 620dc39c2bd18717710fd81690690b543b3e536865d37849dcce8a504ab42bd1
SHA-1: c431abf18460b215308b5319d5b1dce6ada500b9
MD5: fea5c8be52e35c19059976e23db5168c
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 24576:SOCbhrAg2+vPe5Ts6Mt2AJJLKRPJRPmRchqPD2Fgcyg/EP:SLblAyvPe4t2YJ2JJRuykGAg/u
TLSH: T1435233AB71713290E721AE7620CD38EE5C2145A12F596CB55471BCCB30915F3EE2BB88
Submitted as: 620dc39c2bd18717710fd81690690b543b3e536865d37849dcce8a504ab42bd1
File type: pe · Size: 991616 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Dropped a suspicious payload (Container): 1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4 - dynamic signal, weight 0.50, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 37 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12167 behavior events · 2 ATT&CK techniques · 65 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13620/files/c223bb1ce0dca25d905dc6827433d83ae0eed62d15c70336e2e0eaeba6aff436 - c223bb1ce0dca25d905dc6827433d83ae0eed62d15c70336e2e0eaeba6aff436
/opt/CAPEv2/storage/analyses/13620/files/7368e77d0f547797579bad68d017d51499afdaaff0b7f99365029d244cddccb7 - 7368e77d0f547797579bad68d017d51499afdaaff0b7f99365029d244cddccb7
/opt/CAPEv2/storage/analyses/13620/files/1f136ab1d57f737a15af58d0d2fd3f51183fc671a80d8f2098a8bf8b3230fdd9 - 1f136ab1d57f737a15af58d0d2fd3f51183fc671a80d8f2098a8bf8b3230fdd9
/opt/CAPEv2/storage/analyses/13620/files/a69f3585298e65ce7650801e4fc080bb45299335a3d6f0e76b2aa8688e0fb412 - a69f3585298e65ce7650801e4fc080bb45299335a3d6f0e76b2aa8688e0fb412
/opt/CAPEv2/storage/analyses/13620/files/1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4 - 1ac9785462b0e86303d612861b4ed1bb06116d6e8b095a615e724a1427fba7f4
/opt/CAPEv2/storage/analyses/13620/files/670b24b5c1b858d079a9ee8c68bfe8d585b802655e9f48818b9b932c59231452 - 670b24b5c1b858d079a9ee8c68bfe8d585b802655e9f48818b9b932c59231452
/opt/CAPEv2/storage/analyses/13620/files/bf45debffb5010ce59e936c200e4366a202850e353e45cfb8bca60f07d1af20c - bf45debffb5010ce59e936c200e4366a202850e353e45cfb8bca60f07d1af20c
/opt/CAPEv2/storage/analyses/13620/files/a3fc75f1016d789def9017e142c17d16df74624f3b5c385d8d4d0354a7e34a4d - a3fc75f1016d789def9017e142c17d16df74624f3b5c385d8d4d0354a7e34a4d
/opt/CAPEv2/storage/analyses/13620/files/925eac112ff38ab306766099e8f26993a85d74edd3195d98ef8de851cbaab673 - 925eac112ff38ab306766099e8f26993a85d74edd3195d98ef8de851cbaab673
/opt/CAPEv2/storage/analyses/13620/files/69108c86e91eb56c6a95e69eafffc56ee9385d0506b5609498e65c504d97457d - 69108c86e91eb56c6a95e69eafffc56ee9385d0506b5609498e65c504d97457d
/opt/CAPEv2/storage/analyses/13620/files/78a3a3433d2e4b29c4864aafa3b73746f3d7ea3b26995ea0feb05b5918a5f353 - 78a3a3433d2e4b29c4864aafa3b73746f3d7ea3b26995ea0feb05b5918a5f353
/opt/CAPEv2/storage/analyses/13620/files/6cb0840f83db7dd3269db7366b2adc6d6a23e0f76649b87bebc3e6284327c9ae - 6cb0840f83db7dd3269db7366b2adc6d6a23e0f76649b87bebc3e6284327c9ae
/opt/CAPEv2/storage/analyses/13620/files/0c979e2905fd1876582f079dd3140e6340e024841e92e9e469b3029118c95829 - 0c979e2905fd1876582f079dd3140e6340e024841e92e9e469b3029118c95829
/opt/CAPEv2/storage/analyses/13620/files/e68881f8aedc1d9c2027e8c2b1870d95fc566dec2745c1b14f0848f0e3a849af - e68881f8aedc1d9c2027e8c2b1870d95fc566dec2745c1b14f0848f0e3a849af
/opt/CAPEv2/storage/analyses/13620/files/1f05d3df0ea65e8d6fea93722c1073b5c670684ad6eb0c242cd1daa7af71e2de - 1f05d3df0ea65e8d6fea93722c1073b5c670684ad6eb0c242cd1daa7af71e2de

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552497&P2=404&P3=2&P4=gayrbxc2sRGuuh84MGByCPgR7frGq1agLpjmDtJ4fvYtB%2fz0svRKAX27Kv3WFmp2J1WmXptJ2URyZXR6%2bK12pQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552560&P2=404&P3=2&P4=K2Q1NlttVje9fuZ7h6%2b83bIWztq4rO3dedOdE0wwXjC%2bL7WatX2FYUu7Np63MFM27LjW3MBRXDvWR%2fk29b2g6w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

149.154.165.137
149.154.167.99
20.184.175.14
20.247.185.124
48.211.4.16
4.230.171.124
74.178.240.61
52.182.141.63
74.178.76.54
203.26.79.13
74.178.232.29
52.182.143.212
135.234.160.246
92.223.78.30
172.178.240.161
85.210.193.152
72.145.35.97
172.66.2.5
52.148.114.188
20.42.73.25
52.110.12.19
52.110.12.42

File paths

O:\Be

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report