MALICIOUS — 6385c65829a20f091c9ad2d499661807bffeef1e83af820bca94eab67cb6d01b

MALICIOUS — 6385c65829a20f091c9ad2d499661807bffeef1e83af820bca94eab67cb6d01b is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Base64 family. 4 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 6385c65829a20f091c9ad2d499661807bffeef1e83af820bca94eab67cb6d01b
• SHA-1: e91f06bf6cb0ef6762ad1a8a470b91437d97a496
• MD5: 2b5daf2c332f7a1651b0f0c37525d4ae
• ssdeep: 96:xDT6T/vXhDGR8jyhwjYNunDf0R5iYgKAIPFXETuLPR3nL+SaTwMXh0:5qvXhjyhwcJMA3LKTwMXh0
• TLSH: T15D1D9F095D31BFA60D55AF22415F36CAC2E161248002B0D0FDD89079EE7AF753DA5BE2
• Submitted as: 6385c65829a20f091c9ad2d499661807bffeef1e83af820bca94eab67cb6d01b
• File type: script · Size: 6265 bytes
• Verdict: malicious (94/100) · Family: Base64

Detections (4 of 54 engines)

• capa (capabilities): capability:execution/powershell
• YARA: MalwareAnalyser community pack: TL_Base64_EncodedCommand
• Microsoft Defender: Trojan:PowerShell/Rozena.NJA!MTB
• Kaspersky (KVRT): HEUR:Trojan.PowerShell.Generic

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 94/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:PowerShell/Rozena.NJA!MTB (rule Trojan:PowerShell/Rozena.NJA!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PowerShell.Generic (rule HEUR:Trojan.PowerShell.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated powershell script: shellcode-injection (layers: powershell-encodedcommand+base64) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: MalwareAnalyser community pack flagged TL_Base64_EncodedCommand (rule TL_Base64_EncodedCommand) - engine signal, weight 0.45, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

1108 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl

Embedded domains

• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.42.73.30
• 34.104.35.123
• 4.150.223.111
• 52.123.252.241
• 52.110.12.10
• 74.178.240.51
• 4.230.171.124
• 85.210.193.152
• 4.144.132.223
• 52.123.252.203
• 72.154.7.96
• 203.26.79.13
• 92.223.78.30

File paths

• C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\

More Base64 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report