MALICIOUS — 5b85a5729709d3d995231ba0da785d628b264597242a5c4072a4046d420d67b4

MALICIOUS — 5b85a5729709d3d995231ba0da785d628b264597242a5c4072a4046d420d67b4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Agentb family. 3 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 5b85a5729709d3d995231ba0da785d628b264597242a5c4072a4046d420d67b4
SHA-1: a83711bcb49a16134f37e675916a2e822e4b0807
MD5: e0ad1129d291ca2a9414208a6452a6cf
imphash: 123eba4bd09f5c11f2a571d11bf75e35
ssdeep: 1536:PGYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7H:PfU/WF6QMauSuiWNi9CO+WARJrWNZB
TLSH: T10A3A8DAC071E7305DAF6CB515CA06E1E7063A0EEA07F1A8C56C3C06E27E3833E49551A
Submitted as: 5b85a5729709d3d995231ba0da785d628b264597242a5c4072a4046d420d67b4
File type: pe · Size: 95680 bytes
Verdict: malicious (100/100) · Family: Agentb

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Agentb-9639796-0
Microsoft Defender: Trojan:Win32/Gamarue
Kaspersky (KVRT): Trojan.Win32.Agentb.bviq

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Agentb-9639796-0 (rule Win.Malware.Agentb-9639796-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Gamarue (rule Trojan:Win32/Gamarue) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agentb.bviq (rule Trojan.Win32.Agentb.bviq) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 158.69.115.115 - static signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5316 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\ProgramData\Update\wuauclt.exe - 87a1829ca0994d941a408734a2e3e858991061901447e96b2bc052183940c3e6

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788145553&P2=404&P3=2&P4=YlBwINBI6V8tf8wWPm%2fjmN4%2fPUK84Nh35PPAJ6o%2b2rAxdMiILMgmmyBnZ241XsuRdXC24Knz9JnoUASdviOLgw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

158.69.115.115
52.168.112.66
52.123.252.202
4.230.171.124
20.247.184.142
4.247.188.233
20.165.94.63
135.233.95.135
52.168.117.174
74.179.77.204
20.89.1.10
203.26.79.13
52.123.252.204
135.232.92.34
162.159.142.9
172.215.188.225
52.110.12.30
52.110.12.14
4.150.223.101
4.150.223.98
72.153.5.135
52.110.12.8
52.148.114.188
52.110.12.55

File paths

C:\windows\system32\cmd.exe
C:\ProgramData\Update
C:\ProgramData\Update\wuauclt.exe
C:\Program
c:\windows\system32\cmd.exe
E:\Data\My

More Agentb samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report