MALICIOUS — bas-agent

MALICIOUS — bas-agent is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Persistence family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: effcf8b51b8ee0e1e70e78aa4d77c544df7d37a977165ffe17abf9e35b9dcc08
• SHA-1: 12ec948bb5ccdc7b1f6fef2066d4157a379fe0bb
• MD5: 1d16b523acbdbd89677f24864ab9efc7
• ssdeep: 196608:8XJ9FeL8OSzi10kiDx1MnbB7winK6SHCqz:8XJ9FeL89zi10kyx1MbrnK6Sbz
• TLSH: T13C6DBED11D5AB549FBFCF940F4AA9C5C295204C7F37E879C9AA745B1A2EA7339208C00
• Submitted as: bas-agent
• File type: macho · Size: 12896386 bytes
• Verdict: malicious (99/100) · Family: Persistence

Detections (6 of 56 engines)

• YARA: MalwareAnalyser built-in: EICAR_Test_File
• capa (capabilities): capability:credential-access
• YARA: Intezer community: INTEZER_Linux_Persistence
• YARA: ReversingLabs: RL_AsyncRAT
• YARA: MalwareAnalyser community pack: TL_Ransomware_Note_Markers
• YARA: Yara-Rules community: YR_AntiVM_Sandbox

MITRE ATT&CK

• T1555
• T1003

YARA

• EICAR_Test_File

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• EICAR antivirus test string (rule EICAR_Test_File) - yara signal, weight 0.95, confidence 0.90
• YARA: ReversingLabs flagged RL_AsyncRAT (rule RL_AsyncRAT) - engine signal, weight 0.80, confidence 0.70
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• YARA: Intezer community flagged INTEZER_Linux_Persistence (rule INTEZER_Linux_Persistence) - engine signal, weight 0.50, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Ransomware_Note_Markers (rule TL_Ransomware_Note_Markers) - engine signal, weight 0.50, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70
• YARA: MalwareAnalyser built-in flagged EICAR_Test_File (rule EICAR_Test_File) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://dpaste.orgSFTP, https://www.dropbox.comScheduled, https://slack.com/api/api.testwebsocket_exfil - static signal, weight 0.35, confidence 0.60

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

Embedded URLs

• https://dpaste.orgSFTP
• https://api.github.com/github_exfil
• https://www.dropbox.comScheduled
• https://blob.core.windows.netCloud
• https://slack.com/api/api.testwebsocket_exfil
• http://www.google.com/robots.txtRequired
• http://127.0.0.1:19999/bas-payloadLSASS
• http://connectivity-check.ubuntu.com/remote_registry
• http://example.com/%2574%2565%2573%2574wpad_check
• http://127.0.0.1:19999/bas-test
• http://169.254.169.254/metadata/instance?api-version=2021-02-01aws
• https://go.dev/issue/66821
• https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size
• https://example.com
• http://www.apple.com/DTDs/PropertyList-1.0.dtd
• http://www.w3.org/2003/05/soap-envelope
• http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
• http://ifconfig.me

Embedded domains

• github.com
• responseexample.com
• whois.iana.org
• big.int
• swww.google.com
• 443www.github.com
• microsoft.com
• api.github.com
• httpbin.org
• receivedself-signed.badssl.com
• s3.amazonaws.com
• vtracker.opentrackr.org
• example.com
• slack.com
• completedtracker.openbittorrent.com
• external.com
• www.google.com
• storage.googleapis.com
• pastebin.com
• adult.testcategory.com
• social.testcategory.com
• malware.testcategory.com
• connectivity-check.ubuntu.com
• phishing.testcategory.com
• gambling.testcategory.com

Embedded IP addresses

• 0.0.08.8
• 5.4.62.5
• 4.32.5.4
• 52.5.4.72
• 5.4.82.5
• 5.4.102.5
• 4.112.5.4
• 239.255.255.250
• 224.0.0.251
• 8.8.8.8
• 224.0.0.252
• 10.0.0.1
• 192.168.1.1
• 1.1.1.1

File paths

• C:\inetpub\wwwrootFinancial
• t:\:
• l:\8b

More Persistence samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report