MALICIOUS — 88f41c73c771a05f9c1797bc2b11a209609d11a2266799bde36e662c48eeccf2

MALICIOUS — 88f41c73c771a05f9c1797bc2b11a209609d11a2266799bde36e662c48eeccf2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the AgentTesla family. 4 of 25 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 88f41c73c771a05f9c1797bc2b11a209609d11a2266799bde36e662c48eeccf2
SHA-1: a94787daad3f9de76190208f9c662e9a32ec5084
MD5: f317d65160c3a8fcff5378b0dcf64ff4
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:Zm9E29TAlQgLFDQGfJqnmSkZVqP3HR24Oanv9vuyJJdm9E29TAlQgLFDQGfJqnm:QClhF0IZVqqClhF0IZVq
TLSH: T1245AC08F9B784823DCD671359A87867CBC48CD3B4415989ECAC10A436BDD97B4A3A334
Submitted as: 88f41c73c771a05f9c1797bc2b11a209609d11a2266799bde36e662c48eeccf2
File type: pe · Size: 2074624 bytes
Verdict: malicious (94/100) · Family: AgentTesla

Detections (4 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:MSIL/AgentTesla.KA!MTB
Emsisoft (Emergency Kit): Gen:Variant.Barys.326796
Kaspersky (KVRT): HEUR:Trojan-Downloader.MSIL.Seraph.gen

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 94/100 is the fusion of 8 weighted signals:

Microsoft Defender flagged Trojan:MSIL/AgentTesla.KA!MTB (rule Trojan:MSIL/AgentTesla.KA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.326796 (rule Gen:Variant.Barys.326796) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.MSIL.Seraph.gen (rule HEUR:Trojan-Downloader.MSIL.Seraph.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 45 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: 2.10.91.91 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

4973 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

cab287e9f68b20684f2ced46393393165ebec57e81b8722f29bbe076d99de413 - cab287e9f68b20684f2ced46393393165ebec57e81b8722f29bbe076d99de413

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786701288&P2=404&P3=2&P4=JYTWhD024SnPqVms3K8Xm%2fZsWB%2bVCxe27PlqgvGCDgeHgI3XoAa%2bIF972gxrH6xdCqT8kh8aaVqArhEp4GuyKQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

2.10.91.91
0.0.0.4
0.0.0.61
0.0.0.1
0.0.5.3
20.184.175.18
48.211.4.16
52.253.84.76
4.230.171.124
74.178.76.128
74.179.77.164
20.50.201.201
135.234.160.245
52.123.129.14
52.123.252.232
135.234.160.246
52.123.128.14
52.123.252.194
4.207.44.64
92.223.78.30
203.26.79.13
40.99.134.2
20.76.201.171
52.123.252.216
135.232.92.34

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report