SUSPICIOUS — 288c4a8c96e31e487d2b293e1182e7a1f62534db3a2509db98af8bc463fd9c48
SUSPICIOUS — 288c4a8c96e31e487d2b293e1182e7a1f62534db3a2509db98af8bc463fd9c48 is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (69/100). 1 of 54 detection engines flagged it.
Identification
- SHA-256:
288c4a8c96e31e487d2b293e1182e7a1f62534db3a2509db98af8bc463fd9c48 - SHA-1:
68f9194e3ad80225e52f5d7136c4df840e4ed1cd - MD5:
d116a1ca41a87450253434e6a08776e1 - ssdeep:
768:ykEn4cUPjt/uOtcZAugYm42GHUnKaj36cVB/8llH:E4cmx/uOtigYm42G9d - TLSH:
T1E338C0466B81D533DE754018E21EACAC2C1A840B58D64D7F184DF71F9ADEBA31EE90B0 - Submitted as: 288c4a8c96e31e487d2b293e1182e7a1f62534db3a2509db98af8bc463fd9c48
- File type: script · Size: 79519 bytes
- Verdict: suspicious (69/100)
Detections (1 of 54 engines)
- Microsoft Defender: Trojan:PowerShell/CobaltStrike!MTB
Why this verdict
The suspicious score of 69/100 is the fusion of 2 weighted signals:
- Microsoft Defender flagged Trojan:PowerShell/CobaltStrike!MTB (rule
Trojan:PowerShell/CobaltStrike!MTB) - engine signal, weight 0.55, confidence 0.85 - Obfuscated unknown script: dynamic-exec (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Dynamic analysis (windows)
1083 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- desktop-hsgcbep._dosvc._tcp.local
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.209
- 23.11.37.157
- 172.66.2.5 US · San Francisco · AS13335 Cloudflare, Inc.
- 40.126.14.162
- 52.123.252.220 AU · Sydney · AS8075 Microsoft Corporation
- 23.33.238.135
- 52.110.12.56 AU · Sydney · AS8075 Microsoft Corporation
- 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
- 23.33.238.171
- 23.46.10.19
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 74.178.76.128
- 20.50.73.5
- 172.66.2.5
- 52.123.252.220
- 52.110.12.56
- 4.230.171.124
- 57.155.104.224
- 135.232.92.97
- 20.247.185.124
- 20.42.73.31
- 20.42.179.192
File paths
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report