MALICIOUS — afb999e35d9035e1107d8ca93ace7ae959ef02f0af6f603429ab9194dba147b7

MALICIOUS — afb999e35d9035e1107d8ca93ace7ae959ef02f0af6f603429ab9194dba147b7 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 2 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: afb999e35d9035e1107d8ca93ace7ae959ef02f0af6f603429ab9194dba147b7
• SHA-1: 7500370abaf6391ac2d40177b70a9483ff63abb7
• MD5: eb32f4325b955461d52bf9fbe98b2159
• ssdeep: 192:9yFLgQ1qhsBZhCe5drs99ZIV1QIoQcwT31y6h9yqd3hARdutxNWclWps2DzfPku:9yWUws1drsZIV1NxDhm0xYcl4sdu
• TLSH: T18A26C57A7DCC365EC05EB46B7EC9984AB6B65A993489C0C181FDE393B8308D19C18C0D
• Submitted as: afb999e35d9035e1107d8ca93ace7ae959ef02f0af6f603429ab9194dba147b7
• File type: script · Size: 13964 bytes
• Verdict: malicious (83/100)

Detections (2 of 54 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 83/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis (windows)

8562 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• login.live.com
• settings-win.data.microsoft.com
• v10.events.data.microsoft.com
• 21.167.190.20.in-addr.arpa.
• 169.117.168.52.in-addr.arpa.
• ntp.ubuntu.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• 23.40.52.209
• 23.11.37.157
• 40.126.14.163

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• this.opts.top
• s.top

Embedded IP addresses

• 52.123.252.235
• 52.110.12.24
• 4.230.171.124
• 74.179.77.164
• 135.233.95.144
• 172.215.188.225
• 72.154.7.109
• 52.168.117.169

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report