SUSPICIOUS — 89078e68dfe480e597839aa3bf3baf31eab180d866161e9990983bc6c1995c38
SUSPICIOUS — 89078e68dfe480e597839aa3bf3baf31eab180d866161e9990983bc6c1995c38 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100). 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
89078e68dfe480e597839aa3bf3baf31eab180d866161e9990983bc6c1995c38 - SHA-1:
ccbd16143bc1a64129cad54a3de00fe476172b2f - MD5:
a7d284d025d9a76eef20aa3d29874c7c - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
12288:rZKt67yJqg33PA9CfqBGyewUbSSEpa6jB4dSXa2dpqkK:roU7y8g330CISaaSpg - TLSH:
T12F4E62C4ABD93D11EC69487F833C518F4387E1A525F7BD904EA8123A6444E772B2E2B1 - Submitted as: 89078e68dfe480e597839aa3bf3baf31eab180d866161e9990983bc6c1995c38
- File type: pe · Size: 635800 bytes
- Verdict: suspicious (49/100)
Detections (6 of 52 engines)
- capa (capabilities): capability:execution/powershell
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:MSIL/AgentTesla.DLB!MTB
- Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.200455
- Trellix Stinger (McAfee): AgentTesla-FDCV!A7D284D025D9
- Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Reline.gen
MITRE ATT&CK
Why this verdict
The suspicious score of 49/100 is the fusion of 2 weighted signals:
- execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- https://www.digicert.com/CPS0
Embedded domains
- www.digicert.com
- crl3.digicert.com
- crl4.digicert.com
- cacerts.digicert.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report