MALICIOUS — 6730d7ecf4778c88d1d1602f71cef38c5c05c8cf4ab104d39cae96a3a4d240d5

MALICIOUS — 6730d7ecf4778c88d1d1602f71cef38c5c05c8cf4ab104d39cae96a3a4d240d5 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100), attributed to the Webshell family. 2 of 54 detection engines flagged it.

Identification

• SHA-256: 6730d7ecf4778c88d1d1602f71cef38c5c05c8cf4ab104d39cae96a3a4d240d5
• SHA-1: a596732ee7315d39ec8857f03fbe1a42fdb90e10
• MD5: a09e0cc2892eb70dadf61e54541e7932
• ssdeep: 24:WAYIUqftE011enfv8U9AYmEVuuXa8oW+3Ws6uT:pYI9e3f96EcVfxX/T
• TLSH: T11314A1B433A72E29E40AA548496F5084BD2EFFE6897EF664B4F72C84548983035DC411
• Submitted as: 6730d7ecf4778c88d1d1602f71cef38c5c05c8cf4ab104d39cae96a3a4d240d5
• File type: script · Size: 1882 bytes
• Verdict: malicious (72/100) · Family: Webshell

Detections (2 of 54 engines)

• Microsoft Defender: Backdoor:PHP/Webshell!AMTB
• Kaspersky (KVRT): HEUR:Trojan.PHP.Kryptik.gen

Why this verdict

The malicious score of 72/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged Backdoor:PHP/Webshell!AMTB (rule Backdoor:PHP/Webshell!AMTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PHP.Kryptik.gen (rule HEUR:Trojan.PHP.Kryptik.gen) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

1123 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep._dosvc._tcp.local
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.85
• 23.11.37.157
• 40.126.14.163
• 150.171.22.17
• 52.110.12.11 AU · Sydney · AS8075 Microsoft Corporation
• 52.110.12.52 AU · Sydney · AS8075 Microsoft Corporation
• 4.230.171.124 KR · Seoul · AS8075 Microsoft Corporation
• 23.33.238.171
• 20.247.184.197 SG · Singapore · AS8075 Microsoft Corporation
• 23.33.238.111

Dropped files

• aaaa739d44852a3363f87003c1a1a3d2c6fe71c5765187df8e5c625634a40d54 - aaaa739d44852a3363f87003c1a1a3d2c6fe71c5765187df8e5c625634a40d54

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded IP addresses

• 20.42.73.31
• 4.150.223.99
• 172.215.188.232
• 52.110.12.11
• 52.110.12.52
• 4.230.171.124
• 20.247.184.197
• 74.178.240.51
• 4.150.223.96
• 20.50.73.5
• 52.178.17.234
• 40.84.97.4
• 52.148.114.188

More Webshell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report