MALICIOUS — c6bfc84222d2b6bc4982ee762296439624aadd0eb64ca14f6778d2142c7c7f0e

MALICIOUS — c6bfc84222d2b6bc4982ee762296439624aadd0eb64ca14f6778d2142c7c7f0e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Scar family. 8 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c6bfc84222d2b6bc4982ee762296439624aadd0eb64ca14f6778d2142c7c7f0e
• SHA-1: bf422bbc69b600adcd0f47a1760a8e7628d22c7b
• MD5: 0b512ceb211e83d98044569a96f5989e
• imphash: 7c918af5a1e6df2bbd7c14ae4f037b72
• ssdeep: 3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwa:H29qRfVSnt30Bbt+IhDFa
• TLSH: T12A3FBF618306A39ADBFAE7123D901E1E5093B4BEC1FE295813C3C25F66E3997F464049
• Submitted as: c6bfc84222d2b6bc4982ee762296439624aadd0eb64ca14f6778d2142c7c7f0e
• File type: pe · Size: 153664 bytes
• Verdict: malicious (95/100) · Family: Scar

Detections (8 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): (Win)Upack 0.32
• ClamAV (daily): Win.Malware.Scar-6745903-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:(Win)Upack 0.32
• Kaspersky (KVRT): Trojan.Win32.Scar.ojsz
• Microsoft Defender: Trojan:Win32/Cerber.MR!MTB
• Emsisoft (Emergency Kit): Gen:Trojan.Packed.Heur.jqX@oudYSgcjc
• Trellix Stinger (McAfee): Trojan-FDXL!0B512CEB211E

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 95/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Malware.Scar-6745903-0 (rule Win.Malware.Scar-6745903-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:(Win)Upack 0.32 (rule DIE:(Win)Upack 0.32) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: (Win)Upack 0.32 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

File paths

• C:\windows\system32\cmd.exe

More Scar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report