MALICIOUS — e8256ff0303469d5349de6c6e473d0a99ff0268abb0919034f46c38d2e0ae0c6

MALICIOUS — e8256ff0303469d5349de6c6e473d0a99ff0268abb0919034f46c38d2e0ae0c6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e8256ff0303469d5349de6c6e473d0a99ff0268abb0919034f46c38d2e0ae0c6
SHA-1: b551d82a962546d0e0d01cc76ce9f80e19ba4f6d
MD5: 0073781d70c72fdef32024852d491b8e
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 98304:KrQpVU3cYwdUGBNjk4ZL9v4gF5QFTXVFYEeby7md8/i90h:KMW3vaFBp1ZIFDVQxd8/th
TLSH: T12A60335621F69C7AD0C264C852A8ACCE08150F133F6EC95881C226F09665D5FFFDA9CC
Submitted as: e8256ff0303469d5349de6c6e473d0a99ff0268abb0919034f46c38d2e0ae0c6
File type: pe · Size: 3656104 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 948) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47108 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13604/files/ae26c1f598f01a740d5e93f94ed074ae3a26ff494e6c318b1030da94aafbddbe - ae26c1f598f01a740d5e93f94ed074ae3a26ff494e6c318b1030da94aafbddbe
/opt/CAPEv2/storage/analyses/13604/files/eede69821c0b04b2eceb181ca60e0e656eda070fd27869efa9d5d6cfacba387c - eede69821c0b04b2eceb181ca60e0e656eda070fd27869efa9d5d6cfacba387c
/opt/CAPEv2/storage/analyses/13604/files/4811d1cefa6613525bee29a2dc05814917b0e96787b106a327bc40d57a274880 - 4811d1cefa6613525bee29a2dc05814917b0e96787b106a327bc40d57a274880
/opt/CAPEv2/storage/analyses/13604/files/c85e62618760d8e188cdc6d1dc4f357e42ec71e0925152319d1797a60b592e75 - c85e62618760d8e188cdc6d1dc4f357e42ec71e0925152319d1797a60b592e75
/opt/CAPEv2/storage/analyses/13604/files/84432c1c8c963118a2e6336cde4479c2ec420ba8d3fb92c86dfe526ae73cb158 - 84432c1c8c963118a2e6336cde4479c2ec420ba8d3fb92c86dfe526ae73cb158
/opt/CAPEv2/storage/analyses/13604/files/7d90367a6f93e2369441078bc6afeee1b74e3049bb9190bbd6554a85dd0c70c6 - 7d90367a6f93e2369441078bc6afeee1b74e3049bb9190bbd6554a85dd0c70c6
/opt/CAPEv2/storage/analyses/13604/files/153673cb706279bd299633c7ee85131218b151b165c32440d6f8d7866e8837cd - 153673cb706279bd299633c7ee85131218b151b165c32440d6f8d7866e8837cd
/opt/CAPEv2/storage/analyses/13604/files/3adbb8ff4bafaa3f53036fa5af5ee6ededb448f524e8e1462a72a4c06d89f8cf - 3adbb8ff4bafaa3f53036fa5af5ee6ededb448f524e8e1462a72a4c06d89f8cf
/opt/CAPEv2/storage/analyses/13604/files/a650d20c451308f19e7049ac487509ccaf91f3d9214c669fd7cdcc313e2607ad - a650d20c451308f19e7049ac487509ccaf91f3d9214c669fd7cdcc313e2607ad
/opt/CAPEv2/storage/analyses/13604/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13604/files/c7fd0b509ebc8a1362023cb82f9a36443128db714388920f4890b3f535eb2e45 - c7fd0b509ebc8a1362023cb82f9a36443128db714388920f4890b3f535eb2e45
/opt/CAPEv2/storage/analyses/13604/files/c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6 - c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6
/opt/CAPEv2/storage/analyses/13604/files/ec5042f7aa08ef4a9057b4255146b8780cbaa8880bdb1d2c7c52fa86364673c6 - ec5042f7aa08ef4a9057b4255146b8780cbaa8880bdb1d2c7c52fa86364673c6
/opt/CAPEv2/storage/analyses/13604/files/6ac9523bca59bceb582c9e20072dfd2f392d6be5404bdc266a1fe6435c8728ef - 6ac9523bca59bceb582c9e20072dfd2f392d6be5404bdc266a1fe6435c8728ef
/opt/CAPEv2/storage/analyses/13604/files/6fe7531cead9a42d8065d526f3406bcab91e9a17010165b39bc0304430c996f0 - 6fe7531cead9a42d8065d526f3406bcab91e9a17010165b39bc0304430c996f0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552040&P2=404&P3=2&P4=V6eGAPa1G46HWnvqQdJEMoNDPfmc7FA%2bSfPQCDIDmJHJM59pUblheAWjbuCM6GO8o4Lzz3%2bvIa8kfeAAOYOxYw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552064&P2=404&P3=2&P4=BjJh5jVFZ0%2bzmFK2Jgmm%2fSP3bqw%2f3bFJTcaJKFb%2bsydbvIg9mAPLESLETLvvvrDdq%2b%2faJDDCeqMmkUwrXyX0cQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

h.ai

Embedded IP addresses

4.150.223.109
74.178.76.44
4.230.171.124
4.247.188.233
20.247.184.197
74.179.77.204
135.233.95.135
20.184.175.3
74.178.76.128
52.123.252.227
135.233.95.80
203.26.79.13
52.123.252.232
135.233.45.222
72.154.7.113
52.148.114.188
52.110.12.32
52.110.12.48

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report