MALICIOUS — e0d086f1ff22ba011603d22c9018a9caaa57d7bfd731780d2c43e89186d11a31

MALICIOUS — e0d086f1ff22ba011603d22c9018a9caaa57d7bfd731780d2c43e89186d11a31 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Scar family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: e0d086f1ff22ba011603d22c9018a9caaa57d7bfd731780d2c43e89186d11a31
SHA-1: fb5a33b0d7925095a2306ff87581d9a42e090310
MD5: eb1c6a5f6d7103fa20e6b0df78d8e54d
imphash: 7c918af5a1e6df2bbd7c14ae4f037b72
ssdeep: 1536:PQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtry:w29DkEGRQixVSjLaes5G30BO
TLSH: T1083A6C61C206A79AE6FAD7013D901E0E5092B5BED1FF295843C3C22E66F3997F47404A
Submitted as: e0d086f1ff22ba011603d22c9018a9caaa57d7bfd731780d2c43e89186d11a31
File type: pe · Size: 94208 bytes
Verdict: malicious (100/100) · Family: Scar

Detections (6 of 56 engines)

ClamAV (daily): Win.Malware.Scar-6745903-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Cerber.MR!MTB
Emsisoft (Emergency Kit): Gen:Variant.Shyape.19
Trellix Stinger (McAfee): Trojan-FDXL!EB1C6A5F6D71
Kaspersky (KVRT): Trojan.Win32.Scar.ojsz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Scar-6745903-0 (rule Win.Malware.Scar-6745903-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Cerber.MR!MTB (rule Trojan:Win32/Cerber.MR!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Shyape.19 (rule Gen:Variant.Shyape.19) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FDXL!EB1C6A5F6D71 (rule Trojan-FDXL!EB1C6A5F6D71) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.ojsz (rule Trojan.Win32.Scar.ojsz) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 47 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7440 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\MicroMedia\MediaCenter.exe - 00ac3e6c2af051772bc693cbdeb6df30089ea052ed6718f1a997c799a2dcbad0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://www.polarroute.com/newimage.asp?imageid=qrfxgbctuftporc-2146526016&type=0&resid=64187
http://www.polarroute.com/photo/qrfxgbctuftporc-2146526016.jpg?resid=65140
http://www.polarroute.com/viewphoto.asp?resid=65328&photoid=qrfxgbctuftporc-2146526016
http://www.polarroute.com/newimage.asp?imageid=qrfxgbctuftporc-2146526016&type=0&resid=96531
http://www.polarroute.com/photo/qrfxgbctuftporc-2146526016.jpg?resid=96890
http://www.polarroute.com/viewphoto.asp?resid=97078&photoid=qrfxgbctuftporc-2146526016
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://www.polarroute.com/newimage.asp?imageid=qrfxgbctuftporc-2146526016&type=0&resid=128281
http://www.polarroute.com/photo/qrfxgbctuftporc-2146526016.jpg?resid=128656
http://www.polarroute.com/viewphoto.asp?resid=128843&photoid=qrfxgbctuftporc-2146526016
http://www.polarroute.com/newimage.asp?imageid=qrfxgbctuftporc-2146526016&type=0&resid=160046
http://www.polarroute.com/photo/qrfxgbctuftporc-2146526016.jpg?resid=160406
http://www.polarroute.com/viewphoto.asp?resid=160593&photoid=qrfxgbctuftporc-2146526016
http://www.polarroute.com/newimage.asp?imageid=qrfxgbctuftporc-2146526016&type=0&resid=191812
http://www.polarroute.com/photo/qrfxgbctuftporc-2146526016.jpg?resid=192171
http://www.polarroute.com/viewphoto.asp?resid=192343&photoid=qrfxgbctuftporc-2146526016

Embedded domains

www.polarroute.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.113
4.230.171.124
52.230.59.222
4.247.188.233
74.179.77.164
20.184.175.17
135.233.95.144
4.150.223.97
172.64.154.167
13.248.169.48
52.110.12.8
52.110.12.21
57.155.104.224
4.150.223.96
4.150.223.110
135.234.160.244
92.223.78.30
72.145.35.96
52.148.114.188
52.110.12.37
52.110.12.46

File paths

C:\windows\system32\cmd.exe

More Scar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report