MALICIOUS — 40bbc3b0772a0365c7c91858d53373935cd72bbe27a431c976cafa12a2305d2e

MALICIOUS — 40bbc3b0772a0365c7c91858d53373935cd72bbe27a431c976cafa12a2305d2e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 40bbc3b0772a0365c7c91858d53373935cd72bbe27a431c976cafa12a2305d2e
SHA-1: bf34ed7633d5d3e63f159444a609391a4970d19b
MD5: 90c35c3c65e1decb48ed5a35dc012193
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:26j0kJSvaoZZDKYY17TFH4eIkt/grfNG1IRIK+qggvOWxLo:n0UkZZDKYY17TFH4eIkRgrw1xK+qzNx
TLSH: T12F50BE8C2479775CE6F23AB22094A2FDADA7B99D3CB53ED016805C32215DB3B803525D
Submitted as: 40bbc3b0772a0365c7c91858d53373935cd72bbe27a431c976cafa12a2305d2e
File type: pe · Size: 782336 bytes
Verdict: malicious (100/100) · Family: AgentTesla

Detections (5 of 56 engines)

ClamAV (daily): Win.Dropper.Remcos-10026421-0
Microsoft Defender: Trojan:MSIL/AgentTesla.DLM!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDFG!90C35C3C65E1
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

T1547.001

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in tsk_01f0d04c53 (pid 2384) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.DLM!MTB (rule Trojan:MSIL/AgentTesla.DLM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFG!90C35C3C65E1 (rule AgentTesla-FDFG!90C35C3C65E1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted NanoCore config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

10500 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\46D62DD6-6BF0-4298-B49B-A2327301A4F3\run.dat - 5d217355ff597cb1d0e16ef98ee42437d105cbede5427446da736323503dd651
b5e0248087ae5308c095f65a89ee7d5a5c2b53bde71c40598ec9e3b8f8ace812 - b5e0248087ae5308c095f65a89ee7d5a5c2b53bde71c40598ec9e3b8f8ace812
4345295526d476b96c2135fdb8d3d4cd640e10dc700a36b8b2789f05a008f1c3 - 4345295526d476b96c2135fdb8d3d4cd640e10dc700a36b8b2789f05a008f1c3
d81c44d06035a1fe07d211d216d94537d04dbb39c9b2adf6e8906a7afa53c99c - d81c44d06035a1fe07d211d216d94537d04dbb39c9b2adf6e8906a7afa53c99c
1475ff259cba510c9e2d656790301cb453029c9aa83ebfe5fe85c5e2bc518e30 - 1475ff259cba510c9e2d656790301cb453029c9aa83ebfe5fe85c5e2bc518e30
4f2d859d41266f6d783fa04eab4cf9d417e3b748c76615f0fefebe0749c884ba - 4f2d859d41266f6d783fa04eab4cf9d417e3b748c76615f0fefebe0749c884ba
669acdc93787ddb9e0bc1449a5a7d1115391b5c3bb1b0899710652b57d6af91c - 669acdc93787ddb9e0bc1449a5a7d1115391b5c3bb1b0899710652b57d6af91c
b288df49247a323cb795fc0753471aba60caf5e5838944e61abf6c2cc5c9b1df - b288df49247a323cb795fc0753471aba60caf5e5838944e61abf6c2cc5c9b1df
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f - 86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
7724b4a0cee932c4d695ebd8daba445972755adb30f6976c579c99d752e61eac - 7724b4a0cee932c4d695ebd8daba445972755adb30f6976c579c99d752e61eac
61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403 - 61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
a10a1c1b1289040618b5ea69aa51ebd89a34d385ad98bf05de84db3d3ac73a26 - a10a1c1b1289040618b5ea69aa51ebd89a34d385ad98bf05de84db3d3ac73a26
d0f35e8ec328ef30ebc99c470f0393beb425d4f3ed986a80c3b5e232b4c340ec - d0f35e8ec328ef30ebc99c470f0393beb425d4f3ed986a80c3b5e232b4c340ec
362608b383f7a4d3b2e37ff08645cf5dfd40c23a92ae66961f89c80e42fb1065 - 362608b383f7a4d3b2e37ff08645cf5dfd40c23a92ae66961f89c80e42fb1065
f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec - f9b8c3f31375e9a1ec105f930f751869a804110d29d6b38e7298622eb74b2bec

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.codeproject.com
dera31.ddns.net

Embedded IP addresses

13.69.116.108
4.230.171.124
40.84.85.40
52.230.59.222
20.165.94.54
74.179.77.204
20.42.72.131
20.184.175.11
20.165.94.63
92.223.78.30
52.110.12.44
52.110.12.46
195.133.18.211
4.150.223.111
72.154.7.96
52.148.114.188
52.110.12.8
52.110.12.52

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report