MALICIOUS — c28920cd8dd6c0bac0d8b44eb28008fb991da4b062bcd432be489923b7d77f6f

MALICIOUS — c28920cd8dd6c0bac0d8b44eb28008fb991da4b062bcd432be489923b7d77f6f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: c28920cd8dd6c0bac0d8b44eb28008fb991da4b062bcd432be489923b7d77f6f
SHA-1: 996e9bc07889bda6ff4fa520e0d58fb9c05d5b77
MD5: 94aaac66c511056ebb26189d7f3d3ef9
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 98304:FKh+JryVbqflFayUeW8bZSAzThil7dD930tRQPTR:+sFaf41zThqpuRQd
TLSH: T13562332DF8926604C0902F6B094A7F1EA5110D4839FA3EBF40F6F64F95A8503B1DD99B
Submitted as: c28920cd8dd6c0bac0d8b44eb28008fb991da4b062bcd432be489923b7d77f6f
File type: pe · Size: 4435880 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 52 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9195 behavior events · 2 ATT&CK techniques · 21 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13634/files/d242cc3617926adfad9241417465854ef19fd5f42d0e8afb49ac2b089ac4bfc7 - d242cc3617926adfad9241417465854ef19fd5f42d0e8afb49ac2b089ac4bfc7
/opt/CAPEv2/storage/analyses/13634/files/ec296ae00e23b28db1a71c5c8a2bf3d6d9b8da76fb4e592c8fb4969be5cddf45 - ec296ae00e23b28db1a71c5c8a2bf3d6d9b8da76fb4e592c8fb4969be5cddf45
/opt/CAPEv2/storage/analyses/13634/files/4c2c8f9a23e4728edfd39bff1130ccf1e1ce78d12c7045014723fdccbec5811f - 4c2c8f9a23e4728edfd39bff1130ccf1e1ce78d12c7045014723fdccbec5811f
/opt/CAPEv2/storage/analyses/13634/files/7bdeb25043fcfbbe693d299f98ea790ebe38d949112f0cee94801a34963a338f - 7bdeb25043fcfbbe693d299f98ea790ebe38d949112f0cee94801a34963a338f
/opt/CAPEv2/storage/analyses/13634/files/c145b86928b4b0b41a3fe43508a654b6b61a7bb9fff9d63c85d0b22d17be9bd0 - c145b86928b4b0b41a3fe43508a654b6b61a7bb9fff9d63c85d0b22d17be9bd0
/opt/CAPEv2/storage/analyses/13634/files/fb4e559ad510a5197471173cbd009a1b064d89723233317800bd97775abebedb - fb4e559ad510a5197471173cbd009a1b064d89723233317800bd97775abebedb
/opt/CAPEv2/storage/analyses/13634/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13634/files/77d490e59d6e7c099a08ca243122b5e611b04b2b1e9d2bb35c68048d8b814e51 - 77d490e59d6e7c099a08ca243122b5e611b04b2b1e9d2bb35c68048d8b814e51
/opt/CAPEv2/storage/analyses/13634/files/c96820f815f59fc0ec149248a588177bd648e90ce92bc9adf67649c371d7c9b8 - c96820f815f59fc0ec149248a588177bd648e90ce92bc9adf67649c371d7c9b8
/opt/CAPEv2/storage/analyses/13634/files/cf03aa2534f2332b542527c6e3b64b9dc1d868ded9ba5dc0514515bebc64d6ab - cf03aa2534f2332b542527c6e3b64b9dc1d868ded9ba5dc0514515bebc64d6ab
/opt/CAPEv2/storage/analyses/13634/files/a975aff2bed59cef319820cd8e50a318b1ce733d3bfd3e9c52c6a1cd08e5e549 - a975aff2bed59cef319820cd8e50a318b1ce733d3bfd3e9c52c6a1cd08e5e549
/opt/CAPEv2/storage/analyses/13634/files/b5556b177b97884cf65730be698c086f9d44f4c1ec41d988c16d44f11c551aaa - b5556b177b97884cf65730be698c086f9d44f4c1ec41d988c16d44f11c551aaa
/opt/CAPEv2/storage/analyses/13634/files/e147a6284cc158ffcee9f473ace8645c03edea779df49cfcf3c7353783f53f70 - e147a6284cc158ffcee9f473ace8645c03edea779df49cfcf3c7353783f53f70
/opt/CAPEv2/storage/analyses/13634/files/d3dfe74bb4b87ba5226dfd2ccc9abbba017c9cde8d7e26f877e614879eb49207 - d3dfe74bb4b87ba5226dfd2ccc9abbba017c9cde8d7e26f877e614879eb49207
/opt/CAPEv2/storage/analyses/13634/files/b097cfc364d6b0dadb0d215157d3acb29c2c8757290a82e87c6347d0bf8a6f76 - b097cfc364d6b0dadb0d215157d3acb29c2c8757290a82e87c6347d0bf8a6f76

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552870&P2=404&P3=2&P4=EGPrXJRpluG3pQJKhA%2b8Qk3IUWLBWP9T1%2b%2f5I32oSEERyjt8yKmbH95xAH%2f2EMmu6UBxu0q8LlxqpV9s10MyKw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552927&P2=404&P3=2&P4=B7WfMw1FZdJP5BhH%2b3JOW1crqpSMWJwIO2obvt%2fIMNGPnPvrfvWY6DbVkoiQf4%2fbEsyf5vXmkwV%2fAcDS9zYmVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

t7.gq
t.de
oneclient.sfx.ms

Embedded IP addresses

52.110.12.56
20.184.175.14
52.123.252.242
4.230.171.124
85.210.193.152
52.253.84.76
57.154.63.210
74.178.76.128
135.233.95.135
52.182.143.212
4.150.223.110
172.178.240.161
92.223.78.30
4.150.223.98
20.50.73.5
135.233.45.223
203.26.79.13
52.123.252.245
74.178.232.29
52.123.252.239
52.123.128.14
52.148.114.188
72.154.7.112
48.211.4.16
20.184.175.3

File paths

a:\5c
n:\COq
A:\2
Z:\K

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report