MALICIOUS — 21749a0da75c43c9b080cea8c6209e57fd8093e8f14f15201991dcbcb73d58e4

MALICIOUS — 21749a0da75c43c9b080cea8c6209e57fd8093e8f14f15201991dcbcb73d58e4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the AgentAGen family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 21749a0da75c43c9b080cea8c6209e57fd8093e8f14f15201991dcbcb73d58e4
• SHA-1: 124b6a8446c5cdc9442c76709b055d07b9a4ee84
• MD5: 2d75a4ff1814fd294cff41304b8caaa2
• imphash: 0dc45fc10717ab98a0e7786eb257d08f
• ssdeep: 6144:pQ5Ik6EIwu7/7+RjGxvlSpjbpsgluAOjJ0qDI:pOrHtur7+4xNo+5JZDI
• TLSH: T111457D9A4211D6C0FB72BB642E717E0D5072E4DA52BE281C4A57D05E3393CCFA8B0E56
• Submitted as: 21749a0da75c43c9b080cea8c6209e57fd8093e8f14f15201991dcbcb73d58e4
• File type: pe · Size: 281600 bytes
• Verdict: malicious (99/100) · Family: AgentAGen

Detections (4 of 56 engines)

• ClamAV (daily): Win.Dropper.AgentAGen-9917283-0
• Microsoft Defender: Trojan:Win32/Zusy.B!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Barys.389762
• Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Dropper.AgentAGen-9917283-0 (rule Win.Dropper.AgentAGen-9917283-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Zusy.B!MTB (rule Trojan:Win32/Zusy.B!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.389762 (rule Gen:Variant.Barys.389762) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agent.gen (rule HEUR:Trojan.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 13 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5840) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

18900 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• v10.events.data.microsoft.com
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 109.223.150.4.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• settings-win.data.microsoft.com
• 65.167.190.20.in-addr.arpa.
• 224.104.155.57.in-addr.arpa.
• nexusrules.officeapps.live.com
• 145.109.171.150.in-addr.arpa.
• ecs.office.com

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 4.150.223.102
• 57.155.104.224
• 20.184.175.14
• 52.123.252.193
• 40.84.85.40
• 72.145.35.97
• 52.148.114.188
• 72.153.5.140
• 4.150.223.107
• 20.52.64.201
• 57.154.63.210
• 57.155.101.212
• 4.150.223.109
• 20.42.65.85
• 20.42.73.28
• 20.184.175.13
• 40.79.150.122
• 4.150.223.98
• 52.123.252.231
• 52.110.12.15
• 4.230.171.124
• 4.207.44.75
• 52.253.84.76

File paths

• T:\:d:l:t:

More AgentAGen samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report