MALICIOUS — 6aea816af2d1a6987534fea61a9bebc0cc603db885a71c0f6fd79cf20a850b03

MALICIOUS — 6aea816af2d1a6987534fea61a9bebc0cc603db885a71c0f6fd79cf20a850b03 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Scar family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 6aea816af2d1a6987534fea61a9bebc0cc603db885a71c0f6fd79cf20a850b03
SHA-1: 99ee01aefb9d193e8f43d1822bdc1e530dbd1f7c
MD5: a2857c7f89ae443a594c901b7c5ff467
imphash: a42411f92a99576a8bdc136223b60c9a
ssdeep: 1536:Zoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro8:K0hpgz6xGhTjwHN30BE8
TLSH: T1A3388E584307A7CAFAB6D7032C951F4E1093F4FD91BE354816D3C27E76E285399A006A
Submitted as: 6aea816af2d1a6987534fea61a9bebc0cc603db885a71c0f6fd79cf20a850b03
File type: pe · Size: 81408 bytes
Verdict: malicious (100/100) · Family: Scar

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Scar-6745903-0
Microsoft Defender: Trojan:Win32/Sakurel!pz
Emsisoft (Emergency Kit): Gen:Variant.Shyape.19
Kaspersky (KVRT): Trojan.Win32.Scar.okdf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Scar-6745903-0 (rule Win.Malware.Scar-6745903-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10923 behavior events · 3 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - 371c7f5d4a515a36ffe3da6e9a45753772e1a81b7c61c269295063fbc5fde989
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db - 0dc9e64e2b9e237739a6d816d97177119857a547689e610a2087e165833e1d46
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
C:\Users\analyst\AppData\Local\Temp\MicroMedia\MediaCenter.exe - bb188445658d1d5661e820acdb45ba727d3e0c274ca75642b9c625080c616e15

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787765593&P2=404&P3=2&P4=La7dA%2bMbsVoj6C7RX%2fxZi2hPkWaKymRa5FMay%2bfOMngbrrtX8MLn8RPMEH45QLCD7d6m6H6fj1XQV%2bBp6mkiWg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net
citrix.vipreclod.com

Embedded IP addresses

52.110.12.54
52.110.12.52
72.153.5.97
52.182.143.212
52.123.252.213
4.247.188.233
20.247.185.124
4.230.171.124
74.178.76.128
20.42.65.94
74.178.240.51
135.232.92.137
52.123.252.248
72.145.35.102
104.208.16.94
135.234.160.246
52.123.128.14
72.153.5.129
52.148.114.188
74.178.76.44
20.236.44.162
135.233.95.80
20.42.65.90
135.234.160.245
162.159.142.9

More Scar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report