MALICIOUS — 0d35457687062c6c8347306b4a181c0a2a7df7cbc146901ffd02ba80120fbcb9

MALICIOUS — 0d35457687062c6c8347306b4a181c0a2a7df7cbc146901ffd02ba80120fbcb9 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100), attributed to the Wacatac family. 1 of 54 detection engines flagged it.

Identification

• SHA-256: 0d35457687062c6c8347306b4a181c0a2a7df7cbc146901ffd02ba80120fbcb9
• SHA-1: e5afe5221bf9a30617b75adc82bddc070544b77b
• MD5: f957b9a4ce0ec4d007ddc890e0956276
• ssdeep: 192:lcx0U/TRNnT/egpgkL+0o7lDv6HRP0BMHaC14s7EBurmr4RhXptYOnL/IZi0s:lFct/8uRsMHaK7EBuyEjXpqOnMw0s
• TLSH: T14726B84E3FD8B599840045336E890458AEE19C0FF67224C98958CFC99EDEB2774788B7
• Submitted as: 0d35457687062c6c8347306b4a181c0a2a7df7cbc146901ffd02ba80120fbcb9
• File type: script · Size: 14622 bytes
• Verdict: malicious (75/100) · Family: Wacatac

Detections (1 of 54 engines)

• Microsoft Defender: Trojan:Script/Wacatac.B!ml

Why this verdict

The malicious score of 75/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://cleverjump.org/counter.js, https://semalt.com, https://semalt.com/?s= - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1257 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• 23.40.52.209

Embedded URLs

• https://cleverjump.org/counter.js
• https://semalt.com
• https://semalt.com/?s=
• https://semalt.com/popups/popup_wow.php?lang=en
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• kickvox.com
• lodzadwokat.pl
• cloudattiq.com
• bukhraofficial.com
• infantbulbsyringe.com
• ryanlafauci.com
• chrome.google.com
• sites.google.com
• kindhunter.com
• cleverjump.org
• semalt.com
• www.chateauvinochicago.com
• trustpilot.com
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.42.179.192
• 57.154.63.210
• 4.150.223.105
• 51.132.193.105
• 20.165.94.63
• 40.84.97.4
• 52.110.12.20
• 4.230.171.124
• 4.144.132.223
• 20.42.65.94
• 72.153.5.137

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report