MALICIOUS — 2fbb8912d98c74c42401a3eaed7cf5f95cd5f565c2b0619523d751a1e1746c8c
MALICIOUS — 2fbb8912d98c74c42401a3eaed7cf5f95cd5f565c2b0619523d751a1e1746c8c is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the AMTB family. 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2fbb8912d98c74c42401a3eaed7cf5f95cd5f565c2b0619523d751a1e1746c8c - SHA-1:
3f7cfd44a77f2a339eb4a930f1e074d7ff4fa0bd - MD5:
90942e94119dc4409f935b2b85e528d8 - ssdeep:
48:2FFFFFFFFFFFi+FFlFFFFFFFFFFFi+FFlFFFFFFFFFFFi+FFlF2FFFFFFFFFFFi9:fllglP - TLSH:
T1372001D01E8DC871E668E04F0F69DC4D73121582EECEB066FB59F31A124E38724A6660 - Submitted as: 2fbb8912d98c74c42401a3eaed7cf5f95cd5f565c2b0619523d751a1e1746c8c
- File type: script · Size: 8000 bytes
- Verdict: malicious (88/100) · Family: AMTB
Detections (3 of 51 engines)
- Microsoft Defender: Trojan:BAT/Bomb!AMTB
- Emsisoft (Emergency Kit): Gen:Heur.Bat.1
- Kaspersky (KVRT): Trojan.BAT.Bomb.f
MITRE ATT&CK
Why this verdict
The malicious score of 88/100 is the fusion of 5 weighted signals:
- Microsoft Defender flagged Trojan:BAT/Bomb!AMTB (rule
Trojan:BAT/Bomb!AMTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Bat.1 (rule
Gen:Heur.Bat.1) - engine signal, weight 0.55, confidence 0.85 - 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule
tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90 - Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (linux)
870 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- entropy.ubuntu.com
- ntp.ubuntu.com
- 185.125.189.53:443
- 185.125.189.53
- 10.240.0.1
- 185.125.190.56
- 203.26.79.13
- 92.223.78.30
- 20.190.142.165
- 52.123.252.204
- ff02::16
- 255.255.255.255
- ff02::2
- 151.101.30.172
- 91.189.91.157
- 135.233.95.80
- ff02::1:ff12:3456
- 172.172.255.218
Dropped files
- tmp_tmp.NwUjGGTvgd -
09536787348527ca8da9315b22e083efd070b49d3f3a7adbdbf2806be29bd148
Embedded IP addresses
- 203.26.79.13
- 92.223.78.30
- 20.190.142.165
- 52.123.252.204
- 151.101.30.172
- 135.233.95.80
- 172.172.255.218
More AMTB samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report