MALICIOUS — 073014b0a7e0f63737113433a2f65bb6bed016e50f8fac93c49c10af3b5405a5

MALICIOUS — 073014b0a7e0f63737113433a2f65bb6bed016e50f8fac93c49c10af3b5405a5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 073014b0a7e0f63737113433a2f65bb6bed016e50f8fac93c49c10af3b5405a5
SHA-1: 2badf43a03b80601be00d2faf3b833c188080288
MD5: dc36b297afbb82d471bba6ba117130ed
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 1536:K71gTtXUe/tHW274S+0k0rWMP24ijpg7Y+Zq+fpfmfBFomYxlfG:G1gTtkeVHWtS1BmvetfpuffH
TLSH: T1C23BC547C62E8E27C8BF9D5E395784AF96CD8D1ED43A1E70213FB0B09052653CA72026
Submitted as: 073014b0a7e0f63737113433a2f65bb6bed016e50f8fac93c49c10af3b5405a5
File type: pe · Size: 102400 bytes
Verdict: malicious (100/100) · Family: AgentTesla

Detections (7 of 56 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
YARA: InQuest Labs: AgentTesla
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Multiverze!rfn
Emsisoft (Emergency Kit): Gen:Variant.Razy.661246
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
YARA: InQuest Labs flagged AgentTesla (rule AgentTesla) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:Win32/Multiverze!rfn (rule Trojan:Win32/Multiverze!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.661246 (rule Gen:Variant.Razy.661246) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Linker (rule Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15551 behavior events · 3 ATT&CK techniques · 19 dropped files.

Dropped files

6261f9ad2cca2f70d524ccf302d5030fc073e010cdbf73e0f3ddc9b55f3a5006 - 6261f9ad2cca2f70d524ccf302d5030fc073e010cdbf73e0f3ddc9b55f3a5006
2e0160c5f1c67906496828a3d5b51e960c08cfd481b5c7a2cd5b0e2d7c87bca1 - 2e0160c5f1c67906496828a3d5b51e960c08cfd481b5c7a2cd5b0e2d7c87bca1
6433ef8ca0e0ba761ae2f6e7e338323c1bb9a4a4ef7b61fe329cb787a3be9404 - 6433ef8ca0e0ba761ae2f6e7e338323c1bb9a4a4ef7b61fe329cb787a3be9404
586fb37a03bec17e98071bded71991572e7977a13da5e060cbe357f4b91ea4fa - 586fb37a03bec17e98071bded71991572e7977a13da5e060cbe357f4b91ea4fa
0db438ee5495230470e281dae8e01a14e121b4446cea6d2ae2a39a3224b4ef60 - 0db438ee5495230470e281dae8e01a14e121b4446cea6d2ae2a39a3224b4ef60
58a3600552a0dea2db16d7e383fedb1b24bcd1e82583adfc5ca2425631d9f589 - 58a3600552a0dea2db16d7e383fedb1b24bcd1e82583adfc5ca2425631d9f589
a4ae52447a90b8d2ae242107dc4cf77996441ba9c2972032d62a9b8d52543f60 - a4ae52447a90b8d2ae242107dc4cf77996441ba9c2972032d62a9b8d52543f60
c38b7ed5cf5d83e0079524ce4f5e79ff8a4fac75be91d96549ff6f8e60ac78c3 - c38b7ed5cf5d83e0079524ce4f5e79ff8a4fac75be91d96549ff6f8e60ac78c3
3b283b448e2eeec9731dadb8d41f4e0899d5f70344e5b852c5f82f1cdcd63cd0 - 3b283b448e2eeec9731dadb8d41f4e0899d5f70344e5b852c5f82f1cdcd63cd0
947a9b6ab2952dbe92c68b664afce17a1329a8ace4a6867de59a337715421544 - 947a9b6ab2952dbe92c68b664afce17a1329a8ace4a6867de59a337715421544
fd7fe578dd435820401fa6a55231b3d8335ab47b760a20a29199928d38c8d8c3 - fd7fe578dd435820401fa6a55231b3d8335ab47b760a20a29199928d38c8d8c3
6ffea5a66a2dfa9c60b6adaa094f236e5946c0602d9245c5374fa73cb1ba9aeb - 6ffea5a66a2dfa9c60b6adaa094f236e5946c0602d9245c5374fa73cb1ba9aeb
f930b70468e92d73de723fb344e4d45b95c137f6f2b1c73d4bc66125f0cd87c9 - f930b70468e92d73de723fb344e4d45b95c137f6f2b1c73d4bc66125f0cd87c9
0d4b70207b3a0f9057f9dc1441d25e40cc7c9250e52230422f9e5e8960bb5adf - 0d4b70207b3a0f9057f9dc1441d25e40cc7c9250e52230422f9e5e8960bb5adf
9b295f436cc402fbc419ec1d2223ceb48fd375dbb315875ca0fbca64f37ca92c - 9b295f436cc402fbc419ec1d2223ceb48fd375dbb315875ca0fbca64f37ca92c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.207.44.77
20.247.185.124
4.230.171.124
4.150.223.101
20.42.73.28
172.66.2.5
118.220.233.131
85.210.193.152
52.110.12.44
52.110.12.40
172.178.240.162
4.247.188.224
85.210.196.11
72.154.7.16
52.148.114.188
52.110.12.4
52.110.12.15

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report