SUSPICIOUS — 2da776c2d32acd5d0849a164d7bfe013a4a2fa3765cc1ac0c2be270f0d3316bf

SUSPICIOUS — 2da776c2d32acd5d0849a164d7bfe013a4a2fa3765cc1ac0c2be270f0d3316bf is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (62/100), attributed to the Cryxos family. 1 of 50 detection engines flagged it.

Identification

• SHA-256: 2da776c2d32acd5d0849a164d7bfe013a4a2fa3765cc1ac0c2be270f0d3316bf
• SHA-1: cbaa47c8f5ad80813491877927299b1e8b821fd0
• MD5: 6f45f2fdca3ceab02beb6e3aefb78938
• ssdeep: 96:m5Ev4FfbFSCGG/iSrXZlCytT81FAhRVSLj:yEEfbFSCGciSrDCytT81FAhRVSLj
• TLSH: T11B1ABFB69B317EFFAF8625C5690D29AF050320C3B400AA59DA04ADC55C63C991F1CC5C
• Submitted as: 2da776c2d32acd5d0849a164d7bfe013a4a2fa3765cc1ac0c2be270f0d3316bf
• File type: script · Size: 4439 bytes
• Verdict: suspicious (62/100) · Family: Cryxos

Detections (1 of 50 engines)

• Emsisoft (Emergency Kit): JS:Trojan.Cryxos.6249

Why this verdict

The suspicious score of 62/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged JS:Trojan.Cryxos.6249 (rule JS:Trojan.Cryxos.6249) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: http://rediskina.com/f/gstats - static signal, weight 0.35, confidence 0.60
• Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

842 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• 52.123.252.227 AU · Sydney · AS8075 Microsoft Corporation
• 10.240.0.1
• 169.254.255.255
• 23.11.37.157
• ff02::16
• 72.154.7.101 US · Moses Lake · AS8075 Microsoft Corporation
• 185.125.190.56
• 224.0.0.22

Dropped files

• tmp_tmp.oP76y6hRn2 - 7a6f86289484158b70d27511839d2b4efce4438e3caa0dfacf4045e56b016ddb

Embedded URLs

• http://rediskina.com/f/gstats

Embedded domains

• rediskina.com

Embedded IP addresses

• 52.123.252.227
• 72.154.7.101
• 74.178.76.44
• 135.233.95.144

More Cryxos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report