SUSPICIOUS — 240750c78b7938dcfcfa96ff246f13e8878d225301e1e4b852718ca13883fae4

SUSPICIOUS — 240750c78b7938dcfcfa96ff246f13e8878d225301e1e4b852718ca13883fae4 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (62/100), attributed to the Cryxos family. 1 of 51 detection engines flagged it.

Identification

• SHA-256: 240750c78b7938dcfcfa96ff246f13e8878d225301e1e4b852718ca13883fae4
• SHA-1: 40f2a8e3c95f25d16d3e806bdb7f46899e278256
• MD5: 9bbccc2dd77e4817e246fe4d0731754a
• ssdeep: 96:m5Ev4FfbFSCGG/iSrXZlCytT81FAmURVSLj:yEEfbFSCGciSrDCytT81FAmURVSLj
• TLSH: T1B11ACEF69B317EEFAF8625C5690D28AF060321C3B400A969E904A9C59C63C991F1CC5C
• Submitted as: 240750c78b7938dcfcfa96ff246f13e8878d225301e1e4b852718ca13883fae4
• File type: script · Size: 4439 bytes
• Verdict: suspicious (62/100) · Family: Cryxos

Detections (1 of 51 engines)

• Emsisoft (Emergency Kit): JS:Trojan.Cryxos.6249

Why this verdict

The suspicious score of 62/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged JS:Trojan.Cryxos.6249 (rule JS:Trojan.Cryxos.6249) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: http://rediskina.com/f/gstats - static signal, weight 0.35, confidence 0.60
• Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

842 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• entropy.ubuntu.com
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• 185.125.189.53
• 10.240.0.1
• 172.172.255.217
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• ff02::1:2
• ff02::16
• ff02::2
• ff02::1:ff12:3456
• 74.178.76.128
• 4.150.223.104
• 239.255.255.250
• 185.125.190.56
• 224.0.0.22
• 255.255.255.255

Dropped files

• tmp_tmp.dC1bx7kKhi - fe7f0073bf079c9aef8a7c10de9f835eeef8b076a322710c6cbbdeb28bc3f426

Embedded URLs

• http://rediskina.com/f/gstats

Embedded domains

• rediskina.com

Embedded IP addresses

• 172.172.255.217
• 74.178.76.128
• 4.150.223.104

More Cryxos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report