MALICIOUS — 4c4798a6f2ef9d93ca2a70ec1d373f63423b6fd99923b41e53b926b8577087bc
MALICIOUS — 4c4798a6f2ef9d93ca2a70ec1d373f63423b6fd99923b41e53b926b8577087bc is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ramnit family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
4c4798a6f2ef9d93ca2a70ec1d373f63423b6fd99923b41e53b926b8577087bc - SHA-1:
36009db0a901a395ae8333f69a00ec8fcb5022c0 - MD5:
bd2502cb96952a66c2879f77d363cf66 - ssdeep:
6144:ksMYod+X3oI+Y7sMYod+X3oI+YA9sMYod+X3oI+YW:y5d+X3N5d+X3mJ5d+X3c - TLSH:
T1CF48AF959071D18F0907A797A22F728CCF6FE4D1820B3B81555ABB8F092A540FF924E7 - Submitted as: 4c4798a6f2ef9d93ca2a70ec1d373f63423b6fd99923b41e53b926b8577087bc
- File type: html · Size: 353462 bytes
- Verdict: malicious (99/100) · Family: Ramnit
Detections (4 of 51 engines)
- ClamAV (daily): Win.Trojan.Agent-36393
- Microsoft Defender: Virus:VBS/Ramnit.gen!A
- Emsisoft (Emergency Kit): Trojan.Dropper.VBS.Q
- Kaspersky (KVRT): Trojan-Dropper.VBS.Agent.bp
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-36393 (rule
Win.Trojan.Agent-36393) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8140) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Virus:VBS/Ramnit.gen!A (rule
Virus:VBS/Ramnit.gen!A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Dropper.VBS.Q (rule
Trojan.Dropper.VBS.Q) - engine signal, weight 0.55, confidence 0.85 - Obfuscated vbscript script: dynamic-exec (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: http://zg7.com/, http://zg7.com/forum.php;icon-uri=http://zg7.com/template/jingyun_toutiao/zhanzhuaicn_img/common/bbs.ico, http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.css - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
283 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- desktop-hsgcbep
- dns.msftncsi.com
- www.bing.com
- config.edge.skype.com
- msedge.api.cdp.microsoft.com
- edge.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- g.live.com
- fs.microsoft.com
- www.msftncsi.com
- self.events.data.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- watson.events.data.microsoft.com
- 192.168.122.107
- 192.168.122.255
- 224.0.0.252
- 192.168.122.1
Embedded URLs
- http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
- http://www.w3.org/1999/xhtml
- http://zg7.com/
- http://zg7.com/forum.php;icon-uri=http://zg7.com/template/jingyun_toutiao/zhanzhuaicn_img/common/bbs.ico
- http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.css
- http://zg7.com/source/plugin/austgl_audio/player/APlayer.min.js
- https://www.zg7.com/
- http://www.discuz.net
- http://beian.miit.gov.cn/
- http://www.comsenz.com
- http://wpa.qq.com/msgrd?V=3&uin=482773&Site=-
- http://zg7.com/home.php?mod=misc%26ac=sendmail%26rand=1636537804
Embedded domains
- www.w3.org
- zg7.com
- www.zg7.com
- www.discuz.net
- beian.miit.gov.cn
- www.comsenz.com
- wpa.qq.com
More Ramnit samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report