MALICIOUS — f3cc1f1e1558788bbf23c20e404f3b4ed124c47beefa1e6f2a31c8368b5aa265

MALICIOUS — f3cc1f1e1558788bbf23c20e404f3b4ed124c47beefa1e6f2a31c8368b5aa265 is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: f3cc1f1e1558788bbf23c20e404f3b4ed124c47beefa1e6f2a31c8368b5aa265
• SHA-1: 828c259bc9d5cd12d77f77c29fe93243434ed0d7
• MD5: 6e6db9d261758dfe8e6eaf5585bbe8d6
• ssdeep: 48:Eiu6oNDR9SxGkYK2I+mqX11i/nO3KOr1i/VM/apqOt41i/qXR+6ENGDwzgppC2/+:z2RBVsYDwEppC2KclS+2fP68ku
• TLSH: T1131951B1348C5C96D42E4147FF8B30922F4F7A15D2D35488656CDEAB28BA1C52D04EBA
• Submitted as: f3cc1f1e1558788bbf23c20e404f3b4ed124c47beefa1e6f2a31c8368b5aa265
• File type: shell · Size: 4358 bytes
• Verdict: malicious (83/100)

Detections (2 of 54 engines)

• Microsoft Defender: Trojan:JS/Agent.AG!MSR
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 83/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:JS/Agent.AG!MSR (rule Trojan:JS/Agent.AG!MSR) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis (linux)

1200 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• _dosvc._tcp.local
• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• 10.240.0.1
• 185.125.190.56
• ff02::1
• ff02::2
• ff02::1:2
• 20.184.175.16 US · San Jose · AS8075 Microsoft Corporation
• 85.210.193.152 GB · AS8075 MICROSOFT-MAINT
• ff02::16

Embedded domains

• relieffundindia.org

Embedded IP addresses

• 20.184.175.16
• 85.210.193.152
• 40.84.97.4

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report