MALICIOUS — e3a9d60cb3301e7894123ca0abc9f4d44c9f2db65ba17330a907447b83bc1e26

MALICIOUS — e3a9d60cb3301e7894123ca0abc9f4d44c9f2db65ba17330a907447b83bc1e26 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Ramnit family. 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: e3a9d60cb3301e7894123ca0abc9f4d44c9f2db65ba17330a907447b83bc1e26
SHA-1: 2d6615af815e96e389f2a27cfad518803ce706dd
MD5: 564bdb5f893aa463c0fa39d2a08dcdca
ssdeep: 1536:QURe6iGkreGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBA:Q6tQyfkMY+BES09JXAnyrZalI+Yg
TLSH: T1634206495B20ECCF83D61B47A129988C89F9E9EFCA2178C14AD9FF0E0515CA2D7490D7
Submitted as: e3a9d60cb3301e7894123ca0abc9f4d44c9f2db65ba17330a907447b83bc1e26
File type: html · Size: 203799 bytes
Verdict: malicious (87/100) · Family: Ramnit

Detections (3 of 50 engines)

Microsoft Defender: Virus:VBS/Ramnit.gen!C
Emsisoft (Emergency Kit): Trojan.HTML.Ramnit.D
Kaspersky (KVRT): Trojan-Dropper.VBS.Agent.bp

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 87/100 is the fusion of 6 weighted signals:

Microsoft Defender flagged Virus:VBS/Ramnit.gen!C (rule Virus:VBS/Ramnit.gen!C) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.HTML.Ramnit.D (rule Trojan.HTML.Ramnit.D) - engine signal, weight 0.55, confidence 0.85
Contacted 35 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://zz.bdstatic.com/linksubmit/push.js, http://push.zhanzhang.baidu.com/push.js, https://beian.miit.gov.cn/ - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

272 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

e5706a2dda847abf7ebaf41ec38d1e3b6c4235d6429c9cabd23d1eca7c09c278 - e5706a2dda847abf7ebaf41ec38d1e3b6c4235d6429c9cabd23d1eca7c09c278

Embedded URLs

https://zz.bdstatic.com/linksubmit/push.js
http://push.zhanzhang.baidu.com/push.js
https://beian.miit.gov.cn/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786449587&P2=404&P3=2&P4=WgO5trG4NPHTxJRT115DojV9HjYCJ8kJCvNCQjj2YH%2fFw8yyUBBrgde62ZH0aAVSdyB3mh%2bhnpIDbX6dWeraFw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786449634&P2=404&P3=2&P4=RtSMP5r6RoGTNamGfbgmSMfadABTe85lludpbpbYtMtZu4oNtv1JIgM8ruwsig6UoPc2hl8NUNY2S9H9KIU7Fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

zz.bdstatic.com
push.zhanzhang.baidu.com
beian.miit.gov.cn

Embedded IP addresses

51.11.192.48
4.230.171.124
40.84.85.40
20.247.185.124
20.42.179.204
135.233.95.144
74.179.77.164
104.208.16.94
172.178.240.161
20.165.94.46
203.26.79.13
48.199.12.1
4.150.223.110
72.153.5.129
20.42.73.30
92.223.78.30
52.148.114.188
74.178.76.44
52.110.12.1
52.110.12.52

More Ramnit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report