MALICIOUS — bdf0e9c48aae9d88e38aabd03900386d503baa2db5e1ef23669079e492a83a25
MALICIOUS — bdf0e9c48aae9d88e38aabd03900386d503baa2db5e1ef23669079e492a83a25 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.
Identification
- SHA-256:
bdf0e9c48aae9d88e38aabd03900386d503baa2db5e1ef23669079e492a83a25 - SHA-1:
89ea9a9ae1942d5c35fca6d24bd2dacb37822a9b - MD5:
63534204513f09676e382d29c0c0a16a - ssdeep:
96:lg24KbaX15cyOFkNxSQqf9HFQ0ZLjm5rERNdVK7ELIhl/aykZDFl:l54mkmb7m+sg2/aykZDFl - TLSH:
T1F91DFC5C569C7D3F028CAC5380A6C15E856B80DABCE935C3AED893517046EECF84B49B - Submitted as: bdf0e9c48aae9d88e38aabd03900386d503baa2db5e1ef23669079e492a83a25
- File type: script · Size: 5936 bytes
- Verdict: malicious (88/100)
Detections (3 of 54 engines)
- Microsoft Defender: VirTool:VBS/Revshell.A
- Emsisoft (Emergency Kit): Trojan.Generic.38754859
- Kaspersky (KVRT): HEUR:Trojan.MSOffice.Agent.gen
Why this verdict
The malicious score of 88/100 is the fusion of 4 weighted signals:
- Microsoft Defender flagged VirTool:VBS/Revshell.A (rule
VirTool:VBS/Revshell.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Generic.38754859 (rule
Trojan.Generic.38754859) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.MSOffice.Agent.gen (rule
HEUR:Trojan.MSOffice.Agent.gen) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: 5.150.10.88 - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1120 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 250.255.255.239.in-addr.arpa
- ntp.ubuntu.com
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- desktop-hsgcbep(2)._dosvc._tcp.local
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- 192.168.122.114
- 23.40.52.85
- 23.11.37.157
- 20.190.167.18
- 20.247.185.124 SG · Singapore · AS8075 Microsoft Corporation
- 150.171.22.17
- 23.198.40.44
- 52.110.12.20 AU · Sydney · AS8075 Microsoft Corporation
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 5.150.10.88
- 52.168.112.67
- 172.215.188.232
- 51.105.71.136
- 72.154.7.104
- 20.247.185.124
- 52.110.12.20
- 4.230.171.124
- 85.210.193.152
- 72.145.35.96
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report