CLEAN — init.py

CLEAN — __init__.py is a script sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 0 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 30fa8d0cb65b5ea19a35d5f1005862a853ca1105e3bb68cd42109ecbafb97893
SHA-1: d4af52a5c4f468358f49fe8cf0a91586958b9f91
MD5: 813a3685e48b6dc4359acf6ede226d5f
ssdeep: 24:1mveEaF+vqnuZ9UeAlFYdsyGF66xorAqv:/LcsYdsye66+rf
TLSH: T1C3118992820E1D273ECB9E34A6783C3F38831F6C63382202510076E19723FC4761989D
Submitted as: __init__.py
File type: script · Size: 868 bytes
Verdict: clean (0/100)

Detections (0 of 53 engines)

No engine flagged this sample.

MITRE ATT&CK

T1112

Dynamic analysis (windows)

1193 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
to-do.office.com
staging.to-do.officeppe.com
teams.cloud.microsoft
desktop-hsgcbep
desktop-hsgcbep._dosvc._tcp.local
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
250.255.255.239.in-addr.arpa
ntp.ubuntu.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
192.168.122.108
23.40.52.209

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.165.94.46
20.184.175.0
52.123.252.233
135.232.92.137
20.42.179.204
135.232.92.34
72.153.5.136
162.159.36.2
4.230.171.124

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report