MALICIOUS — 751c194a69bb56608c070ad2b2cb2e780b8623b97d1b9b5349eac41b1e5e6859
MALICIOUS — 751c194a69bb56608c070ad2b2cb2e780b8623b97d1b9b5349eac41b1e5e6859 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
751c194a69bb56608c070ad2b2cb2e780b8623b97d1b9b5349eac41b1e5e6859 - SHA-1:
523199b034e42d26d15170213ea9d186eeaa2582 - MD5:
67a99818373ab7395f80bdca005c9805 - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 877952 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
2356 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- oneocsp.microsoft.com
- odc.officeapps.live.com
- windows.msn.com
- www.msn.com
- licensing.mp.microsoft.com
- assets.msn.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13622/files/3ddc07233cf1dbbd997f342e4275d65d613b6e84ad86c6abe7f80f2e21b30ccd —
3ddc07233cf1dbbd997f342e4275d65d613b6e84ad86c6abe7f80f2e21b30ccd - /opt/CAPEv2/storage/analyses/13622/files/d35711351f4735d9954cb227edd85e3d59e7cf5b35218270850214d12321ec2b —
d35711351f4735d9954cb227edd85e3d59e7cf5b35218270850214d12321ec2b - /opt/CAPEv2/storage/analyses/13622/files/fe38aec6a478b3ba6786a5a7a14a55c3455ed34e606b8d5c70b23e6c1d90a580 —
fe38aec6a478b3ba6786a5a7a14a55c3455ed34e606b8d5c70b23e6c1d90a580 - /opt/CAPEv2/storage/analyses/13622/files/2c220ad1b09cad98c44de0a50feaceac76a0a5db289b948f80afd35ad10cab62 —
2c220ad1b09cad98c44de0a50feaceac76a0a5db289b948f80afd35ad10cab62 - /opt/CAPEv2/storage/analyses/13622/files/adb3697162b8a1c45c13aaeb91a567784a19a5e6eba39faa843e1e4710aa36d8 —
adb3697162b8a1c45c13aaeb91a567784a19a5e6eba39faa843e1e4710aa36d8 - /opt/CAPEv2/storage/analyses/13622/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13622/files/5eb9de69a2526f0f6f45ac72b75064e11fd93cb839890dafce2b06b2d11f6643 —
5eb9de69a2526f0f6f45ac72b75064e11fd93cb839890dafce2b06b2d11f6643 - /opt/CAPEv2/storage/analyses/13622/files/516607d25ada97bbbd4a50dd996249fb44879afc4b2c83c824643568bf9bef25 —
516607d25ada97bbbd4a50dd996249fb44879afc4b2c83c824643568bf9bef25 - /opt/CAPEv2/storage/analyses/13622/files/3121b9d614c0b0f7434c1644d059713b119d5ed86eda0bb6943df4d1cee47c6e —
3121b9d614c0b0f7434c1644d059713b119d5ed86eda0bb6943df4d1cee47c6e - /opt/CAPEv2/storage/analyses/13622/files/99787742f0dc66ec84b1eef305d0f5f77ea86072b5e6853ee36a5d2998af9991 —
99787742f0dc66ec84b1eef305d0f5f77ea86072b5e6853ee36a5d2998af9991 - /opt/CAPEv2/storage/analyses/13622/files/5e339685a174f8c5d3e1008a2f50a2f9645cb7da288ac4feb52407f5a0c48028 —
5e339685a174f8c5d3e1008a2f50a2f9645cb7da288ac4feb52407f5a0c48028 - /opt/CAPEv2/storage/analyses/13622/files/706601edaf7ac0ecb2238296e1129e0cf9682239fee536c960b95a18588ecb26 —
706601edaf7ac0ecb2238296e1129e0cf9682239fee536c960b95a18588ecb26 - /opt/CAPEv2/storage/analyses/13622/files/c45f11d07b712cb61a88ed9fc656dd3c2c8134e0d4e0c3a1ccf58eabc785fc65 —
c45f11d07b712cb61a88ed9fc656dd3c2c8134e0d4e0c3a1ccf58eabc785fc65 - /opt/CAPEv2/storage/analyses/13622/files/70d66e98fca67d17adc16814027cdf4bb9b2a794da0bf83cd461e9cc15ddadbf —
70d66e98fca67d17adc16814027cdf4bb9b2a794da0bf83cd461e9cc15ddadbf - /opt/CAPEv2/storage/analyses/13622/files/d5b3af2d167de3f7d9bd37268455e24a612b218298dedfabcf0cd35dca9a7254 —
d5b3af2d167de3f7d9bd37268455e24a612b218298dedfabcf0cd35dca9a7254
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552558&P2=404&P3=2&P4=DPKBgpjqK29mTL6RUgYn6%2fEajQj70FFLOCC0govkUOl2jGacbGlIsx8inkhefKsSOhZRtY6PDupcFaY%2b8XdrIg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552627&P2=404&P3=2&P4=kIYeR6lkXc1fD5IA2LEQxQecwu3hLlFXWmsuKKEsXf6fbYrkgo%2bwPxHQnJquKDaImxhUKvWr3cdKZjs2dDck4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 52.182.143.212
- 57.154.63.210
- 4.144.132.114
- 4.230.171.124
- 74.178.240.61
- 4.150.223.107
- 74.178.76.54
- 4.150.223.103
- 135.233.45.222
- 203.26.79.13
- 74.178.232.29
- 40.79.167.9
- 172.66.2.5
- 52.123.252.195
- 52.123.252.244
- 72.145.35.107
- 52.123.252.226
- 52.148.114.188
- 52.110.12.40
- 52.110.12.4
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report