MALICIOUS — fb47cea26f9f21a8528c3d2c5e82bec9817672a3a403f8742df39590f5200f17

MALICIOUS — fb47cea26f9f21a8528c3d2c5e82bec9817672a3a403f8742df39590f5200f17 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: fb47cea26f9f21a8528c3d2c5e82bec9817672a3a403f8742df39590f5200f17
SHA-1: eb496946872ec09e2d0d689e6937d5da169b220c
MD5: 32fa710c1d9d56ff25f58a7a5c0dd57c
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 1536:egKcR4mjD9r82pzxlo1P7xGN9qJlefZS4rE8oL5gr:5KcWmjRrzJo1jxGNawBS246r
TLSH: T157380270B870D680DBFAF40A7088947FF251BE4774FE4393A585E71A6D0512B82F6A60
Submitted as: fb47cea26f9f21a8528c3d2c5e82bec9817672a3a403f8742df39590f5200f17
File type: pe · Size: 83880 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 43 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2350 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13598/files/8e6a8f550098b86b8e926480b3b5deb7a87e685499bc1a6eaee39c46c393988a - 8e6a8f550098b86b8e926480b3b5deb7a87e685499bc1a6eaee39c46c393988a
/opt/CAPEv2/storage/analyses/13598/files/1b6127d9bac281a1c731a577456b4d94315c90f4467f81188046b29e4ce75fba - 1b6127d9bac281a1c731a577456b4d94315c90f4467f81188046b29e4ce75fba
/opt/CAPEv2/storage/analyses/13598/files/778972a22ba7d190f91185e851d932fd21df0329e5af46e0c471b0d7513c55ab - 778972a22ba7d190f91185e851d932fd21df0329e5af46e0c471b0d7513c55ab
/opt/CAPEv2/storage/analyses/13598/files/6e1253507a388ed16a4ca9d5be5250bddbcc7f5e9b018f23555494a49853d313 - 6e1253507a388ed16a4ca9d5be5250bddbcc7f5e9b018f23555494a49853d313
/opt/CAPEv2/storage/analyses/13598/files/f1e4b689f0c09f54950e931de2d53933d445371def8665ce91e969d1e06fea61 - f1e4b689f0c09f54950e931de2d53933d445371def8665ce91e969d1e06fea61
/opt/CAPEv2/storage/analyses/13598/files/b357d1cd83833a61dafbfdcb36bd19992e05f69bfebdb416618755bb08074d10 - b357d1cd83833a61dafbfdcb36bd19992e05f69bfebdb416618755bb08074d10
/opt/CAPEv2/storage/analyses/13598/files/ba373ef17f1be075fab325d25af389e2a3ac72909c8677ab0dcbcea8e5dde9d3 - ba373ef17f1be075fab325d25af389e2a3ac72909c8677ab0dcbcea8e5dde9d3
/opt/CAPEv2/storage/analyses/13598/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13598/files/c8a977db8347c4fe13fa737ff124bc876a9a42ee5536cea0b5aa05fcd4a57a00 - c8a977db8347c4fe13fa737ff124bc876a9a42ee5536cea0b5aa05fcd4a57a00
/opt/CAPEv2/storage/analyses/13598/files/94c596106949a674cd0408a52e3f0543c37f1ab1d089baad9c532284a4a368b1 - 94c596106949a674cd0408a52e3f0543c37f1ab1d089baad9c532284a4a368b1
/opt/CAPEv2/storage/analyses/13598/files/5391b14dc5cd1898b2537eba894b3f009bd1650ef310517ea874abb1c8048e49 - 5391b14dc5cd1898b2537eba894b3f009bd1650ef310517ea874abb1c8048e49
/opt/CAPEv2/storage/analyses/13598/files/41fb2b2c4768bdd7c6e1eadb5fe9dea4afd8c2ca7ddcafe6ad124cf370e458a8 - 41fb2b2c4768bdd7c6e1eadb5fe9dea4afd8c2ca7ddcafe6ad124cf370e458a8
/opt/CAPEv2/storage/analyses/13598/files/74102fa0add0f01c970e0d89220ec17cc4f1941cf7e034a857b055c3753b166d - 74102fa0add0f01c970e0d89220ec17cc4f1941cf7e034a857b055c3753b166d
/opt/CAPEv2/storage/analyses/13598/files/ce377357481c88864aa4afd292ca1fe481791d60b326a1f168c1c35cfb252c68 - ce377357481c88864aa4afd292ca1fe481791d60b326a1f168c1c35cfb252c68
/opt/CAPEv2/storage/analyses/13598/files/726d855d8e05da1be4997f736408b3c3b65a626d98e7da29bd31814aa0854793 - 726d855d8e05da1be4997f736408b3c3b65a626d98e7da29bd31814aa0854793

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786551885&P2=404&P3=2&P4=cpGA%2fxJCJOAlGXe6TS8V9iTWE4XXqyzOZm6BXm7o%2fYqU2b8DR%2bCQldrRTuoVCWvq1i9VLKIZew4N8X7ZXEKisg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786551904&P2=404&P3=2&P4=eCa5gCcQ3y16ajEEj1CgomBSRnCBhtwQCm4yK71i0TLiJpfzBNz1%2fDl%2f9P769J1v4xI9nlQXhfL7oUXl%2b8iPjw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

r.tv

Embedded IP addresses

52.178.17.234
52.123.252.238
20.247.184.197
20.42.179.192
4.230.171.124
52.110.12.28
74.178.240.61
135.233.95.135
20.184.175.5
52.110.12.24
52.168.112.67
135.233.45.223
74.178.76.44
203.26.79.13
85.210.196.11
52.168.117.171
20.42.73.26
172.66.2.5
52.123.252.231
72.153.5.133
162.159.142.9
52.148.114.188
172.217.25.195
52.110.12.37
52.110.12.8

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report