MALICIOUS — 183409d79cfd80dca36a796b541e58f6285c0a01eac0c8e1dba77c9485a83499

MALICIOUS — 183409d79cfd80dca36a796b541e58f6285c0a01eac0c8e1dba77c9485a83499 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 183409d79cfd80dca36a796b541e58f6285c0a01eac0c8e1dba77c9485a83499
• SHA-1: a159d2a932a057738dce9862235565a47629ff3f
• MD5: cf0e46055c1df5577e9b68b5acbc788e
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 12288:DU6JagMdQVaTZWtkkdss8O9bygEDHJ6IhOc49hd6Jlj:DYTYD5hzCj
• TLSH: T1C14D72C88F4C2E12CE6959FB8BBC517E43C7E945A5F3BDC002A422256D04E674BA52F1
• Submitted as: 183409d79cfd80dca36a796b541e58f6285c0a01eac0c8e1dba77c9485a83499
• File type: pe · Size: 619928 bytes
• Verdict: malicious (97/100)

Detections (6 of 56 engines)

• capa (capabilities): capability:execution/powershell
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Trojan:MSIL/AgentTesla.DLB!MTB
• Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.200455
• Trellix Stinger (McAfee): AgentTesla-FDCV!CF0E46055C1D
• Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Reline.gen

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 97/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:MSIL/AgentTesla.DLB!MTB (rule Trojan:MSIL/AgentTesla.DLB!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.MSILHeracles.200455 (rule Gen:Variant.MSILHeracles.200455) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged AgentTesla-FDCV!CF0E46055C1D (rule AgentTesla-FDCV!CF0E46055C1D) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan-PSW.MSIL.Reline.gen (rule UDS:Trojan-PSW.MSIL.Reline.gen) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0
• https://www.digicert.com/CPS0

Embedded domains

• www.digicert.com
• crl3.digicert.com
• crl4.digicert.com
• cacerts.digicert.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report