MALICIOUS — 5cef37f1f5ed3bd0708b5f4385844ff64d08fb05f8d03cc8627c365e0b66ddb6

MALICIOUS — 5cef37f1f5ed3bd0708b5f4385844ff64d08fb05f8d03cc8627c365e0b66ddb6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Remcos family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5cef37f1f5ed3bd0708b5f4385844ff64d08fb05f8d03cc8627c365e0b66ddb6
SHA-1: 238dea82bceacf0607637898814386b28ce5ddae
MD5: 39da24741997dc9373c8b1ba9fadcf5b
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:VRWzQhItvDIQxdRJBP3Sg8xLXTTFH4exqvCpQS81AUAuLZ:OJBP3Sg81jTFH4eUvCWSBUXLZ
TLSH: T12F4E9DCD2578A749F2F53AB32098E6EEADD7798928F53FD015805C22225EB3B813105D
Submitted as: 5cef37f1f5ed3bd0708b5f4385844ff64d08fb05f8d03cc8627c365e0b66ddb6
File type: pe · Size: 663552 bytes
Verdict: malicious (99/100) · Family: Remcos

Detections (5 of 56 engines)

ClamAV (daily): Win.Dropper.Remcos-10026421-0
Microsoft Defender: Trojan:MSIL/AgentTesla.DLM!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDFG!39DA24741997
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

T1518.001

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:MSIL/AgentTesla.DLM!MTB (rule Trojan:MSIL/AgentTesla.DLM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFG!39DA24741997 (rule AgentTesla-FDFG!39DA24741997) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90

Dynamic analysis (windows)

7062 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

58ae447ebec19853e7bb475884e6e054296b98e8c8a83c546d084c3ac3ece5f1 - 58ae447ebec19853e7bb475884e6e054296b98e8c8a83c546d084c3ac3ece5f1
bedcd88eeb783753575996e8365cbd1c1dcd3062dce575334f4a1b2b72623bbf - bedcd88eeb783753575996e8365cbd1c1dcd3062dce575334f4a1b2b72623bbf
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f - 86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
39e831c4ebe8a0be1559ec7f07f1485857858b8ed078818b757b571d3f487d35 - 39e831c4ebe8a0be1559ec7f07f1485857858b8ed078818b757b571d3f487d35
e252f7527cf36764d806cb6c91a9265f614e96d9395a14b32afa2821334eed37 - e252f7527cf36764d806cb6c91a9265f614e96d9395a14b32afa2821334eed37

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.codeproject.com

Embedded IP addresses

20.184.175.18
52.123.252.193
4.230.171.124
172.215.188.225
4.144.132.223
40.84.97.4
20.165.94.54
20.165.94.63
20.184.175.13
104.18.33.89
74.179.77.204
135.234.160.246
125.56.205.26
52.110.12.8
125.56.205.113
52.110.12.28

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report