MALICIOUS — 8e3478bd7c5c312b3de53829fbf7492f81a424c5018d59920cd8a792e1269cf8

MALICIOUS — 8e3478bd7c5c312b3de53829fbf7492f81a424c5018d59920cd8a792e1269cf8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8e3478bd7c5c312b3de53829fbf7492f81a424c5018d59920cd8a792e1269cf8
SHA-1: 76433da2ff7b5621582cf628f41518335e2f9cfb
MD5: 8361a6c1dba1ba7448d0dd251e92d567
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 12288:ScxP6wOAZndkqsyTBhBU0q/w6ZmtTgy9hwxu+m93YCr7EmO8/3:ScxCVSdoEhBK/6BhK2oED3
TLSH: T1BB50236057316B19DBA16D3CF8300C7C9974318E06EB5D1AABBA7089CADCC77F486A10
Submitted as: 8e3478bd7c5c312b3de53829fbf7492f81a424c5018d59920cd8a792e1269cf8
File type: pe · Size: 795520 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 34 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2354 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13645/files/7c05ffcfdf4651a85f552d3e29379100e5ac6c72cc23dd3f1495773409a541cd - 7c05ffcfdf4651a85f552d3e29379100e5ac6c72cc23dd3f1495773409a541cd
/opt/CAPEv2/storage/analyses/13645/files/81a4514ffa712f477d48df2cfc3292395e8e8e167a697b757ccc6a88b31bb384 - 81a4514ffa712f477d48df2cfc3292395e8e8e167a697b757ccc6a88b31bb384
/opt/CAPEv2/storage/analyses/13645/files/c48d0e6a38830f0ede0b7394abd5794180947dbb283a28e4e1cca1d9cc3c24a1 - c48d0e6a38830f0ede0b7394abd5794180947dbb283a28e4e1cca1d9cc3c24a1
/opt/CAPEv2/storage/analyses/13645/files/21e8f1af43deb2f873b4d76112260af89954a2e61b65e482157bbd92ab3dc2c4 - 21e8f1af43deb2f873b4d76112260af89954a2e61b65e482157bbd92ab3dc2c4
/opt/CAPEv2/storage/analyses/13645/files/217ece29141ee36093b92bb4f8f166a6d5acee9e965d822e32a88e8f05271365 - 217ece29141ee36093b92bb4f8f166a6d5acee9e965d822e32a88e8f05271365
/opt/CAPEv2/storage/analyses/13645/files/0f745e72aa62149316cbeeed97a3d829f4e9169374e4698aca960c739f2c27eb - 0f745e72aa62149316cbeeed97a3d829f4e9169374e4698aca960c739f2c27eb
/opt/CAPEv2/storage/analyses/13645/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13645/files/32d6f69a1e09a108b1f35a550e4e8bd8935765bb8f4261df885027a485762e87 - 32d6f69a1e09a108b1f35a550e4e8bd8935765bb8f4261df885027a485762e87
/opt/CAPEv2/storage/analyses/13645/files/beac8253719a26197d99f11906fc80d1422ddeb457bb0aa9c712c544289c4c15 - beac8253719a26197d99f11906fc80d1422ddeb457bb0aa9c712c544289c4c15
/opt/CAPEv2/storage/analyses/13645/files/32fc78bbaa18573543ea471b0d7b6aedc119ae32123e2d2d8d77f3cee9dd2497 - 32fc78bbaa18573543ea471b0d7b6aedc119ae32123e2d2d8d77f3cee9dd2497
/opt/CAPEv2/storage/analyses/13645/files/59fec72b371af6033b459eb6816628e459f62f156fb02ea208f66c046f595de8 - 59fec72b371af6033b459eb6816628e459f62f156fb02ea208f66c046f595de8
/opt/CAPEv2/storage/analyses/13645/files/e72f19875fd65f2976f69d731083d52ac6ce314c290b45778a872531615e072a - e72f19875fd65f2976f69d731083d52ac6ce314c290b45778a872531615e072a
/opt/CAPEv2/storage/analyses/13645/files/a50647343c2b4e242f3982bc8ea2f023aff50c6b98c3ddcd287ca654baee51c1 - a50647343c2b4e242f3982bc8ea2f023aff50c6b98c3ddcd287ca654baee51c1
/opt/CAPEv2/storage/analyses/13645/files/81e958e53d2255d55c3906677d25eb3636781da6c41d1f4f5cc48f97f1a0e105 - 81e958e53d2255d55c3906677d25eb3636781da6c41d1f4f5cc48f97f1a0e105
/opt/CAPEv2/storage/analyses/13645/files/e7d7c4ccce42747bb15d827bdd7f5910ec6200687a442f8019ab4a6fc7a6a5f5 - e7d7c4ccce42747bb15d827bdd7f5910ec6200687a442f8019ab4a6fc7a6a5f5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786553183&P2=404&P3=2&P4=F2AqFLGlSGqkqy2th12SSYiv0hx8B1g8F12i76xfptjmhE9efS6bT1RHFnPB8%2fVeffjv2DAaOuCn9VCNVBBMww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786553232&P2=404&P3=2&P4=MTYaPGir1ODRo8%2bFfX2eqfxDZcR2vOAEyuSyByNiBfZfImvda9TjGPQNT4KRuGlQ5xdAs9HBjF6SAdAsPL2Png%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

5.tw
r.nl
b.ch

Embedded IP addresses

4.247.188.224
52.168.117.175
52.123.252.219
20.247.185.124
4.230.171.124
172.215.188.225
4.150.223.100
74.178.76.128
135.232.92.97
20.165.94.63
20.42.65.85
172.178.240.162
92.223.78.30
85.210.193.152
203.26.79.13
74.178.232.29
72.145.35.98
52.148.114.188
52.110.12.18
52.110.12.42

File paths

M:\F)

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report