MALICIOUS — d4e58c56f7436a3f6f29feceddda22d1f992a746e494f3f407025a85baa693bb

MALICIOUS — d4e58c56f7436a3f6f29feceddda22d1f992a746e494f3f407025a85baa693bb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Prepscram family. 5 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d4e58c56f7436a3f6f29feceddda22d1f992a746e494f3f407025a85baa693bb
SHA-1: 48da4e9f48f4ea6985cb621b8c93f9114c2b4611
MD5: 6e79290c84fffec77b9e3fa58b66d224
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 24576:S2bZi9bQ7ZrdF/5bFiQRcjLNN+CdOYWpnGURolkLTGwS:S2Ni9bgrr/p0QRcjLNN+CdOT5G8olsT+
TLSH: T1D15233FFA782F4E9C3B7F005F25F386E423837512418A35A5E1619AEB29407F4688456
Submitted as: d4e58c56f7436a3f6f29feceddda22d1f992a746e494f3f407025a85baa693bb
File type: pe · Size: 925568 bytes
Verdict: malicious (89/100) · Family: Prepscram

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Detect It Easy (packer/type): DIE:UPX
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25

MITRE ATT&CK

Why this verdict

The malicious score of 89/100 is the fusion of 5 weighted signals:

Dropped a malicious payload (Zusy): ea3f90b8182b634ce628da964431a5ba9f0e3de630f4345f5d2ad9026cb35958 - dynamic signal, weight 0.80, confidence 0.90
Contacted 41 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2359 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/20229/files/ea3f90b8182b634ce628da964431a5ba9f0e3de630f4345f5d2ad9026cb35958 - ea3f90b8182b634ce628da964431a5ba9f0e3de630f4345f5d2ad9026cb35958
/opt/CAPEv2/storage/analyses/20229/files/d39dd39043ad4618e436b5a6f8d28b05000bd93ef8f702a12dc0a2d4fc7a5cc8 - d39dd39043ad4618e436b5a6f8d28b05000bd93ef8f702a12dc0a2d4fc7a5cc8
/opt/CAPEv2/storage/analyses/20229/files/665b759cef9ac9d41118642ff9c1ed387fcb5e65c2c4f9f7e2db2a3cc418fb26 - 665b759cef9ac9d41118642ff9c1ed387fcb5e65c2c4f9f7e2db2a3cc418fb26
/opt/CAPEv2/storage/analyses/20229/files/f4c52895dfed4bac397fb3cf51675be3d21dfecb5212ddd19e328e16ff7ef433 - f4c52895dfed4bac397fb3cf51675be3d21dfecb5212ddd19e328e16ff7ef433
/opt/CAPEv2/storage/analyses/20229/files/59ca3083af7b3be8fd9a6c05b956073aac7ab562c9bd09b73ff05fa17726d607 - 59ca3083af7b3be8fd9a6c05b956073aac7ab562c9bd09b73ff05fa17726d607
/opt/CAPEv2/storage/analyses/20229/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/20229/files/b4b24ac8fa0debedab8b44453bfbe560e47b35c62dd07f436008ef76b380b95c - b4b24ac8fa0debedab8b44453bfbe560e47b35c62dd07f436008ef76b380b95c
/opt/CAPEv2/storage/analyses/20229/files/9a44b890920196cf37e01412154b1629060b49e2132a2d217eaa46e51a1b0759 - 9a44b890920196cf37e01412154b1629060b49e2132a2d217eaa46e51a1b0759
/opt/CAPEv2/storage/analyses/20229/files/fd68b200c633f1348fb664780be34029a90c99b3a5dd4cc49d2798183c34ddc8 - fd68b200c633f1348fb664780be34029a90c99b3a5dd4cc49d2798183c34ddc8
/opt/CAPEv2/storage/analyses/20229/files/f1727ab546247d4d0e56a288e3815dd27aaccf5a10e51ec3817e26de2ee730ec - f1727ab546247d4d0e56a288e3815dd27aaccf5a10e51ec3817e26de2ee730ec
/opt/CAPEv2/storage/analyses/20229/files/c65f5aebcad85132170437015a359959ebe295b084f8bb835edb188b083d3f80 - c65f5aebcad85132170437015a359959ebe295b084f8bb835edb188b083d3f80
/opt/CAPEv2/storage/analyses/20229/files/c4006daaad1ac2d32df6073b64aa6ccde31e3b54705d841a738bae0e033f23e8 - c4006daaad1ac2d32df6073b64aa6ccde31e3b54705d841a738bae0e033f23e8
/opt/CAPEv2/storage/analyses/20229/files/868605a57971a007aa563093e3aad961f0f7f7b883650287106388a5e549778a - 868605a57971a007aa563093e3aad961f0f7f7b883650287106388a5e549778a
/opt/CAPEv2/storage/analyses/20229/files/2db3b09777256557f7ad1e80ea9d83ed8e5a5127cb2133dd176188126002a9cd - 2db3b09777256557f7ad1e80ea9d83ed8e5a5127cb2133dd176188126002a9cd
/opt/CAPEv2/storage/analyses/20229/files/1b27879edf7f30778cd08608d861494c50e3f643d2a71ab6f44b11b194635155 - 1b27879edf7f30778cd08608d861494c50e3f643d2a71ab6f44b11b194635155

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1786768656&P2=404&P3=2&P4=ZJ2q3OaaFN3DQB5dUuXix7Y%2fQV47jcych7PRps5r9Cac5KeJvkpr0xhMaVsl%2f8xtc6P7ZH8KCwOJFc%2bvNqh50g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/1d8d0488-0a3b-440b-b2a9-36df2b9d4ebd?P1=1786768735&P2=404&P3=2&P4=fXtyIgVI3s0FmwgvLnkAmmEwVjYU2aZ6Owz9IAUDCX8XykkhR6p5OAtTQ1li96lI9Vq%2fnPehe5gz4NdSp3pmOw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.7
57.155.104.224
20.247.184.142
4.230.171.124
48.211.4.16
74.178.240.61
51.116.246.104
74.178.76.54
74.178.76.128
52.123.252.231
20.236.44.162
52.123.128.14
52.123.129.14
52.182.143.212
52.123.252.245
203.26.79.13
135.234.160.246
135.232.92.34
72.145.35.114
52.148.114.188
52.110.12.16
52.110.12.5

File paths

T:\UF2q
G:\;7

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report