user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:MSIL/Heracles.AB!MTB
Trojan:MSIL/Heracles.AB!MTB - Windows Defender threat signature analysis

Trojan:MSIL/Heracles.AB!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:MSIL/Heracles.AB!MTB
Classification:
Type:Trojan
Platform:MSIL
Family:Heracles
Detection Type:Concrete
Known malware family with identified signatures
Variant:AB
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for .NET (Microsoft Intermediate Language) platform, family Heracles

Summary:

This is a .NET-based Trojan from the Heracles family, identified as Trojan:MSIL/Heracles.AB!MTB. The malware is obfuscated using the 'Confuser' tool to evade analysis and likely communicates with a remote server to exfiltrate data or receive commands, as indicated by its ability to bypass security certificate validation. Its malicious nature was confirmed through machine learning behavioral detection (!MTB).

Severity:
Medium
VDM Static Detection:
Relevant strings associated with this threat:
 - lpProceskcabllaCnoitadilaVtreCetomeRytiruceSteNmetsyS81617 (PEHSTR_EXT)
 - HttpUtility (PEHSTR_EXT)
 - HttpServerUtility (PEHSTR_EXT)
 - GetExecutingAssembly (PEHSTR_EXT)
 - Confuser.Core 1.6.0+447341964f (PEHSTR_EXT)
 - Sprauncy.exe (PEHSTR_EXT)
YARA Rule:
rule Trojan_MSIL_Heracles_AB_2147849707_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:MSIL/Heracles.AB!MTB"
        threat_id = "2147849707"
        type = "Trojan"
        platform = "MSIL: .NET intermediate language scripts"
        family = "Heracles"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_PEHSTR_EXT"
        threshold = "10"
        strings_accuracy = "High"
    strings:
        $x_10_1 = {fe 0c 01 00 fe 0c 02 00 93 fe 0e 03 00 fe 0c 00 00 fe 0c 03 00 fe 09 02 00 59 d1 6f 07 00 00 0a 26 fe 0c 02 00 20 01 00 00 00 58 fe 0e 02 00 fe 0c 02 00 fe 0c 01 00 8e 69 32 c5}  //weight: 10, accuracy: High
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}
Known malware which is associated with this threat:
Filename: QUOTATION PO - No 20251103 WTS EQPT EXP IMP.pdf 87KB.exe
04e1f69458d2d6d073a4b61f97ba8a4d1219f8d57d4d682b48b9473bfc5dd1d4
19/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected system from the network. Use antivirus to remove the threat (e.g., Sprauncy.exe). Scan for persistence mechanisms like startup entries or scheduled tasks and review network logs for suspicious outbound connections. Change all user passwords associated with the machine and consider reimaging it if a wider compromise is suspected.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 19/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊