MALICIOUS — 9f5efaa5e6b470e9ca2200d2812b5c2e35bcd3c2562e2df2998a618bf72677b0
MALICIOUS — 9f5efaa5e6b470e9ca2200d2812b5c2e35bcd3c2562e2df2998a618bf72677b0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
9f5efaa5e6b470e9ca2200d2812b5c2e35bcd3c2562e2df2998a618bf72677b0 - SHA-1:
3f889a353b137e1cfad212979c10c7a116432068 - MD5:
ee9cf86b5c1854f1ed168dddf5dcb941 - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 4781440 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
46767 behavior events · 2 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13532/files/c23b0eece023adf3eab21d82dfbd27ca1dfa74ffe2923f0f6d159bad081e72cd —
c23b0eece023adf3eab21d82dfbd27ca1dfa74ffe2923f0f6d159bad081e72cd - /opt/CAPEv2/storage/analyses/13532/files/72ecc45e331486c94e746cd0144e66f2e7d572a22f616a7b34f396f18a9b02ff —
72ecc45e331486c94e746cd0144e66f2e7d572a22f616a7b34f396f18a9b02ff - /opt/CAPEv2/storage/analyses/13532/files/a421fa531187224f6c35ae33fb7ab70faf6dac44998097e7f3f5d1998f5baed6 —
a421fa531187224f6c35ae33fb7ab70faf6dac44998097e7f3f5d1998f5baed6 - /opt/CAPEv2/storage/analyses/13532/files/392753aaa2aede564f6cca0aa7cad3cc4f11a0d00fdd55dcaa3360c0fe756502 —
392753aaa2aede564f6cca0aa7cad3cc4f11a0d00fdd55dcaa3360c0fe756502 - /opt/CAPEv2/storage/analyses/13532/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13532/files/6a1c23263eac42ce9a8be4ecd434119aa2db59c431f188e2ad0a66613dfe6bfb —
6a1c23263eac42ce9a8be4ecd434119aa2db59c431f188e2ad0a66613dfe6bfb - /opt/CAPEv2/storage/analyses/13532/files/7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69 —
7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69 - /opt/CAPEv2/storage/analyses/13532/files/e85d83ecd4628f8eb34f5c4dbc9c3f55dc024f80c96cc2b61fdad70683109c97 —
e85d83ecd4628f8eb34f5c4dbc9c3f55dc024f80c96cc2b61fdad70683109c97 - /opt/CAPEv2/storage/analyses/13532/files/753012ff31fc4f3d1e4fbb3a1a5c154e4e80a26369898ecc91f50ec2c0b49f3f —
753012ff31fc4f3d1e4fbb3a1a5c154e4e80a26369898ecc91f50ec2c0b49f3f - /opt/CAPEv2/storage/analyses/13532/files/8ae7db7e20125507d9de2f13d5463231061b6c2ecf68d86cc76014d47f19ab6e —
8ae7db7e20125507d9de2f13d5463231061b6c2ecf68d86cc76014d47f19ab6e - /opt/CAPEv2/storage/analyses/13532/files/53ee7222886cd9f16a24bcedecc68cb1d0c938a65c3badc3f3a46ca89e1af3c6 —
53ee7222886cd9f16a24bcedecc68cb1d0c938a65c3badc3f3a46ca89e1af3c6 - /opt/CAPEv2/storage/analyses/13532/files/956fe5c3c57da50ce5cfce09ce6f39929d3309fa62c403307b552e8736312c6d —
956fe5c3c57da50ce5cfce09ce6f39929d3309fa62c403307b552e8736312c6d - /opt/CAPEv2/storage/analyses/13532/files/67783523c0d94209d008d97a18ff389ead7f67ca0778a77a4b0afa8f9d047ad3 —
67783523c0d94209d008d97a18ff389ead7f67ca0778a77a4b0afa8f9d047ad3 - /opt/CAPEv2/storage/analyses/13532/files/2852dfc1000dfd3d5c93cbc28321f8f89faa67f3c8b86aa77fe4141694569934 —
2852dfc1000dfd3d5c93cbc28321f8f89faa67f3c8b86aa77fe4141694569934 - /opt/CAPEv2/storage/analyses/13532/files/3cb567d0c7adac0255d1aa43fbd0546c6f5dddad8281e4976143bf6e1dc5033b —
3cb567d0c7adac0255d1aa43fbd0546c6f5dddad8281e4976143bf6e1dc5033b
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786550170&P2=404&P3=2&P4=RLliIMW3ZM05n9R1CA6Ogd9RY7wa%2bJpqS6bZk18tyFBebyhle2ogACQwzzK9NuaQj4o4CEMcMdI2GKvGoy8CoQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786550248&P2=404&P3=2&P4=EOI6fZ6CEA8A%2b6LQHzif8vO7FXODr1eAk4ULCcJ0JEQ9bThKEsUX84tZqNLNsHObaur7XwbwGEhIYw7P84uekg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- d.su
Embedded IP addresses
- 4.207.44.68
- 4.230.171.124
- 4.247.188.224
- 4.144.132.114
- 40.84.85.40
- 135.233.95.144
- 135.232.92.97
- 51.132.193.104
- 203.26.79.13
- 135.234.160.244
- 74.178.76.44
- 135.233.45.222
- 172.215.188.232
- 72.154.7.101
- 52.110.12.40
- 52.110.12.10
- 52.148.114.188
- 52.110.12.33
- 52.110.12.4
File paths
- W:\=i
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report