MALICIOUS — 42e73963eb434e600a9631f2e161562b6de2178e522b07b26adf3ee6cd38c26d

MALICIOUS — 42e73963eb434e600a9631f2e161562b6de2178e522b07b26adf3ee6cd38c26d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the AgentTesla family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 42e73963eb434e600a9631f2e161562b6de2178e522b07b26adf3ee6cd38c26d
SHA-1: 4afdcc88c2389ed5f91fde1348764b468216b7de
MD5: c6b25558b36146b5a9810b44bf8de109
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 98304:I6Wg/9ncz0gNR50XtsH3ez01U8RDFVIAHE3BQSP:I6/2Ia2Xc3T6Ak3
TLSH: T13261123DCDB1C2BFFBB70693181746EE2079797C58606097002CFB50D50A66B29786BA
Submitted as: 42e73963eb434e600a9631f2e161562b6de2178e522b07b26adf3ee6cd38c26d
File type: pe · Size: 4140544 bytes
Verdict: malicious (99/100) · Family: AgentTesla

Detections (4 of 55 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:^8X}H|
ClamAV (daily): Win.Dropper.AgentTesla-9916533-0
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Dropper.AgentTesla-9916533-0 (rule Win.Dropper.AgentTesla-9916533-0) - engine signal, weight 0.90, confidence 0.95
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:^8X}H| (rule high-entropy-sections:^8X}H|) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Packing/obfuscation: high-entropy-sections:^8X}H| - static signal, weight 0.25, confidence 0.55
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1148 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

ea7ba06c957ced66df43d00a4ca6c19010a28534f5017bb31ccb7057746a4d37 - ea7ba06c957ced66df43d00a4ca6c19010a28534f5017bb31ccb7057746a4d37
bfa98dc2534875f46af770132bb80e772bc3d466def9748701b8e5ec069624f2 - bfa98dc2534875f46af770132bb80e772bc3d466def9748701b8e5ec069624f2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

d.za
5.mx
80.ml

Embedded IP addresses

4.207.44.74
74.178.240.51
4.230.171.124
57.154.63.210
20.42.65.88
74.178.76.128
4.150.223.112
52.253.84.76
172.64.154.167
135.234.160.244
20.42.179.192
52.110.12.22
52.110.12.8

File paths

J:\e
O:\e
u:\i_

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report