MALICIOUS — 7bf275a660ac18b15a874e256c3055916d4debb1d3f7b071acfa2ef08e04d1bd

MALICIOUS — 7bf275a660ac18b15a874e256c3055916d4debb1d3f7b071acfa2ef08e04d1bd is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100). 2 of 54 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 7bf275a660ac18b15a874e256c3055916d4debb1d3f7b071acfa2ef08e04d1bd
• SHA-1: bba2ceb8686cec745c2a1eef265fe9a9cf64f570
• MD5: f1ec3f0ff0ac2a517885565966a521a3
• ssdeep: 48:jAy15/0JsEko6iDkAJVOhv23daBuQokpdIRmEWJvlZ/2ECR0YFAIf2nFfbmzsDZL:j55s13cf23M7vAW8faYAXlbmoo0
• TLSH: T1B3153216F9756A184BC6B16D4D182612CEE7DC3EB141EEA253C44B83E09F64B107B037
• Submitted as: 7bf275a660ac18b15a874e256c3055916d4debb1d3f7b071acfa2ef08e04d1bd
• File type: script · Size: 2546 bytes
• Verdict: malicious (72/100)

Detections (2 of 54 engines)

• Microsoft Defender: Trojan:JS/Nemucod.SMQ!MTB
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.SLoad.gen

MITRE ATT&CK

• T1543.003
• T1112

Why this verdict

The malicious score of 72/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged Trojan:JS/Nemucod.SMQ!MTB (rule Trojan:JS/Nemucod.SMQ!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Script.SLoad.gen (rule HEUR:Trojan-Downloader.Script.SLoad.gen) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

6258 behavior events · 2 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 53e4d1be.upstream.fishslayerjigco.com
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Dropped files

• 99eeb18f2a94fc44582e127a625bf8297118d0286acb1183be99444c0da91481 - 99eeb18f2a94fc44582e127a625bf8297118d0286acb1183be99444c0da91481

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• 53e4d1be.upstream.fishslayerjigco.com
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.184.175.8
• 20.184.175.0
• 4.150.223.115
• 20.42.179.204
• 52.168.117.171
• 52.110.12.10
• 4.230.171.124
• 20.42.73.25
• 20.247.185.124
• 20.165.94.63
• 104.18.33.89
• 172.178.240.163

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report