MALICIOUS — ec94e4b4eb3b12f16af7a921c7eaed4b1cab0efb25928ee864066266ea586e89
MALICIOUS — ec94e4b4eb3b12f16af7a921c7eaed4b1cab0efb25928ee864066266ea586e89 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
ec94e4b4eb3b12f16af7a921c7eaed4b1cab0efb25928ee864066266ea586e89 - SHA-1:
497d85f801c555f50c0464915919cdfd733c582b - MD5:
adbdaaa683097ddc7994299cd8f3e2d1 - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 4781440 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
47218 behavior events · 2 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- tas02.sls.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13605/files/762eabf7ffa85f9b7d7cf3eabba3799b5d10a52ce6d994d478ccd8b3fb134784 —
762eabf7ffa85f9b7d7cf3eabba3799b5d10a52ce6d994d478ccd8b3fb134784 - /opt/CAPEv2/storage/analyses/13605/files/cfd02e99483d1bf177998b401662b79368004450f05b459fcdd0831eceb2fd5b —
cfd02e99483d1bf177998b401662b79368004450f05b459fcdd0831eceb2fd5b - /opt/CAPEv2/storage/analyses/13605/files/9b616fbde7277f6f50950f778170e680e326e54bffe1b3d37beecb2d2f1b4b4b —
9b616fbde7277f6f50950f778170e680e326e54bffe1b3d37beecb2d2f1b4b4b - /opt/CAPEv2/storage/analyses/13605/files/e4b577906b281605fe76e8cb392d9ac584b45e4ae8f66b46e9dcf5d624574af9 —
e4b577906b281605fe76e8cb392d9ac584b45e4ae8f66b46e9dcf5d624574af9 - /opt/CAPEv2/storage/analyses/13605/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13605/files/7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69 —
7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69 - /opt/CAPEv2/storage/analyses/13605/files/77e664762c2b0e0ae4ba9b391442c1822a4c1478b7b5834cc230d27a62d9db1c —
77e664762c2b0e0ae4ba9b391442c1822a4c1478b7b5834cc230d27a62d9db1c - /opt/CAPEv2/storage/analyses/13605/files/8eb8a98f48e3cc34619a988dd59595c35c84b854c46bca601733727e2f17ef65 —
8eb8a98f48e3cc34619a988dd59595c35c84b854c46bca601733727e2f17ef65 - /opt/CAPEv2/storage/analyses/13605/files/f3ad3ad38534c6ffe9e9122e9a6faab3b22de5ec58e7ccfd85a5f08f3bb131b4 —
f3ad3ad38534c6ffe9e9122e9a6faab3b22de5ec58e7ccfd85a5f08f3bb131b4 - /opt/CAPEv2/storage/analyses/13605/files/538d1d29c1fc64907c6085a8206a23d966fb935759b9d054b9fa363814298453 —
538d1d29c1fc64907c6085a8206a23d966fb935759b9d054b9fa363814298453 - /opt/CAPEv2/storage/analyses/13605/files/e2a6ce53c4aea5b9fbaa4e85dbd77af3787e7617e7ea3589981f73ab20c632f9 —
e2a6ce53c4aea5b9fbaa4e85dbd77af3787e7617e7ea3589981f73ab20c632f9 - /opt/CAPEv2/storage/analyses/13605/files/7bb2b8bfbe3ca46ee2b1105cc43bf78ac433a88a6c9fb4900cfebb21662ef418 —
7bb2b8bfbe3ca46ee2b1105cc43bf78ac433a88a6c9fb4900cfebb21662ef418 - /opt/CAPEv2/storage/analyses/13605/files/e4e563f2b13f3f85f5a5917f78bbe16baaea45ffc9101c18b92a06132d5972ea —
e4e563f2b13f3f85f5a5917f78bbe16baaea45ffc9101c18b92a06132d5972ea - /opt/CAPEv2/storage/analyses/13605/files/38228e70bef187dc434f8bb932b12ddd96d6834e485eb617783d07e813e30bb4 —
38228e70bef187dc434f8bb932b12ddd96d6834e485eb617783d07e813e30bb4 - /opt/CAPEv2/storage/analyses/13605/files/8ee49a62dd0e0ed329f470a695cf1c80ebe2d8c184521c75a97f8bd97efa324c —
8ee49a62dd0e0ed329f470a695cf1c80ebe2d8c184521c75a97f8bd97efa324c
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552069&P2=404&P3=2&P4=f3kW5ILNpyZlywRuQsydJKkc%2b%2fOORFYsNzgUKoKHfyb%2bZjQJDDiKYk6jtJvw1pfqUAGXUYUI2y3kJfgiqgpOoQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552111&P2=404&P3=2&P4=jL68NnDprHgQwWdQtdU8p0ePdWQU3OpeU9BfEYSWTMvq6Uzdz3V%2fHwX026%2fJuFrWIvJm9m0T9qzrv2wXHtWhtg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- 6.fi
- y.ml
- 6.mx
Embedded IP addresses
- 20.184.175.23
- 4.230.171.124
- 20.247.184.197
- 4.247.188.233
- 74.178.76.128
- 135.233.95.135
- 20.42.72.131
- 135.233.95.80
- 203.26.79.13
- 135.233.45.223
- 92.223.78.30
- 52.110.12.30
- 52.110.12.46
- 135.233.45.221
- 72.154.7.113
- 52.148.114.188
- 52.110.12.32
- 52.110.12.21
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report