MALICIOUS — 6048eb85c29c9852a1075997add5a4b00201efd11e0a68ed59f896dfa4ce5dc8
MALICIOUS — 6048eb85c29c9852a1075997add5a4b00201efd11e0a68ed59f896dfa4ce5dc8 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6048eb85c29c9852a1075997add5a4b00201efd11e0a68ed59f896dfa4ce5dc8 - SHA-1:
129126ada381184a31e17bef55abf828e487dba0 - MD5:
d7b59a835da1eb07cb0ff884f8b584be - ssdeep:
1536:vVIKCKVLi+CKgvMZtFdTMviTcARGXiWOF:yK7u+vNAnQF - TLSH:
T1AC36E78F3CA97ECD9D0A34973DCC99EA7B122E157C5294C491BDC38A48F09906C5C89B - Submitted as: 6048eb85c29c9852a1075997add5a4b00201efd11e0a68ed59f896dfa4ce5dc8
- File type: script · Size: 69118 bytes
- Verdict: malicious (83/100)
Detections (2 of 54 engines)
- Microsoft Defender: Trojan:JS/Agent.AG!MSR
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 83/100 is the fusion of 3 weighted signals:
- Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule
Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Dynamic analysis (windows)
1220 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- desktop-hsgcbep(2)._dosvc._tcp.local
- desktop-hsgcbep(3)._dosvc._tcp.local
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 23.40.52.209
- 23.11.37.157
- 20.190.167.64
- 52.110.12.33 US · AS8075 Microsoft Corporation
- 52.110.12.28 AU · Sydney · AS8075 Microsoft Corporation
- 20.247.184.142 SG · Singapore · AS8075 Microsoft Corporation
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- e.top
- h.top
- youtube.com
- www.youtube.com
- vimeo.com
- player.vimeo.com
- demo.rebooku.com
- d.top
- e.prototype.to
- this.to
- b.name
- b.property.name
- a.property.name
- img.youtube.com
- vzaar.com
- view.vzaar.com
- c.property.name
Embedded IP addresses
- 203.26.79.13
- 172.178.240.161
- 48.211.4.16
- 4.150.223.110
- 4.150.223.114
- 52.110.12.33
- 52.110.12.28
- 20.247.184.142
- 4.230.171.124
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report