MALICIOUS — 381592ba0fd2c605628118c02e0a6225f6552390b8f8f985c60eeacbe4b89b89

MALICIOUS — 381592ba0fd2c605628118c02e0a6225f6552390b8f8f985c60eeacbe4b89b89 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ramnit family. 4 of 54 detection engines flagged it.

Identification

SHA-256: 381592ba0fd2c605628118c02e0a6225f6552390b8f8f985c60eeacbe4b89b89
SHA-1: 2b0dbe6f199b923d2c73114b2c618cf786bf0d9c
MD5: 1244fafb7e8bad362e9d46086fe98814
ssdeep: 6144:ksMYod+X3oI+YqsMYod+X3oI+YglsMYod+X3oI+YW:y5d+X3e5d+X3iR5d+X3c
TLSH: T1B448AF959071D18F0907A797A22F728CCF6FE4D1820B3B81555ABB8F092A540FF924E7
Submitted as: 381592ba0fd2c605628118c02e0a6225f6552390b8f8f985c60eeacbe4b89b89
File type: html · Size: 353462 bytes
Verdict: malicious (99/100) · Family: Ramnit

Detections (4 of 54 engines)

ClamAV (daily): Win.Trojan.Agent-36393
Microsoft Defender: Virus:VBS/Ramnit.gen!A
Emsisoft (Emergency Kit): Trojan.Dropper.VBS.Q
Kaspersky (KVRT): Trojan-Dropper.VBS.Agent.bp

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-36393 (rule Win.Trojan.Agent-36393) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:VBS/Ramnit.gen!A (rule Virus:VBS/Ramnit.gen!A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Dropper.VBS.Q (rule Trojan.Dropper.VBS.Q) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.VBS.Agent.bp (rule Trojan-Dropper.VBS.Agent.bp) - engine signal, weight 0.55, confidence 0.85
Obfuscated vbscript script: dynamic-exec (layers: base64) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://zg7.com/, http://zg7.com/forum.php, http://zg7.com/template/jingyun_toutiao/zhanzhuaicn_img/common/bbs.ico - static signal, weight 0.35, confidence 0.60
Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

286 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
http://www.w3.org/1999/xhtml
http://zg7.com/
http://zg7.com/forum.php
http://zg7.com/template/jingyun_toutiao/zhanzhuaicn_img/common/bbs.ico
http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.css
http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.js
https://www.zg7.com/
http://www.discuz.net
http://beian.miit.gov.cn/
http://www.comsenz.com
http://wpa.qq.com/msgrd?V=3&amp
http://zg7.com/home.php?mod=misc%26ac=sendmail%26rand=1636517217
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.w3.org
zg7.com
www.zg7.com
www.discuz.net
beian.miit.gov.cn
www.comsenz.com
wpa.qq.com
aefd.nelreports.net

Embedded IP addresses

4.150.223.97
52.123.252.224
4.230.171.124
4.247.188.224
135.232.92.97
20.42.65.84
74.178.240.61
20.247.184.142
104.18.33.89
74.178.76.128
92.223.78.30
72.154.7.17
52.148.114.188
52.110.12.55
52.110.12.21

More Ramnit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report