MALICIOUS — 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7

MALICIOUS — 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the MSILMamut family. 8 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7
SHA-1: d6c548a83fda174734cd803cf25352532b04750d
MD5: 795c78ac9fc27fbd74134d3bf3247fa8
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 1536:yZNP9MTDcsReb5983B6K9QJc/h9MGRZR8Q:ONP9MHR64kuQeO
TLSH: T10C352A9AD42E5B26C03F6D21745BC6EF8AC61C2FC43F0BB0262E72756234B579572122
Submitted as: 8b89fdf7c7909848e69002fd4212e9649a8db8aa2c974c365e56860a7a08aaf7
File type: pe · Size: 60928 bytes
Verdict: malicious (100/100) · Family: MSILMamut

Detections (8 of 56 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Trojan.Generic-6417450-0
YARA: InQuest Labs: AgentTesla
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: flagged
Emsisoft (Emergency Kit): IL:Trojan.MSILMamut.4377
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-6417450-0 (rule Win.Trojan.Generic-6417450-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
YARA: InQuest Labs flagged AgentTesla (rule AgentTesla) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged IL:Trojan.MSILMamut.4377 (rule IL:Trojan.MSILMamut.4377) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Linker (rule Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

15744 behavior events · 3 ATT&CK techniques · 17 dropped files.

Dropped files

b14d91c574a5db4b827eb646b4f6f59b0fc301e204f26351e23c4609855cc976 - b14d91c574a5db4b827eb646b4f6f59b0fc301e204f26351e23c4609855cc976
c971ba396381791d9472a13cefc55cf908479603a43b39bfbb260b31661cde94 - c971ba396381791d9472a13cefc55cf908479603a43b39bfbb260b31661cde94
9eb90b1e310f360ef37fc0e07cce2bac1afc7562c90c8c04a0cf0be4c0a2be91 - 9eb90b1e310f360ef37fc0e07cce2bac1afc7562c90c8c04a0cf0be4c0a2be91
2295809d826a677257a0e86dab439cca67a1d75c83bc4d804a52c06a3c2046a9 - 2295809d826a677257a0e86dab439cca67a1d75c83bc4d804a52c06a3c2046a9
a7c2062e6ea4a81f91d2cdb3030c4d740aaa3d01c6fdf81c22e4dee186c138b9 - a7c2062e6ea4a81f91d2cdb3030c4d740aaa3d01c6fdf81c22e4dee186c138b9
5f02539dcbed4458af8818cddae83042eccedd28bab2bd49b1b43970c864fd5c - 5f02539dcbed4458af8818cddae83042eccedd28bab2bd49b1b43970c864fd5c
c7a07e955b757a5a049063e095b9e96307d108473d548ad465e1f864c6231ee2 - c7a07e955b757a5a049063e095b9e96307d108473d548ad465e1f864c6231ee2
9547f687aa008cce0f5e16107a3cf5d89c5c63cf41c448cb285f336b43c25205 - 9547f687aa008cce0f5e16107a3cf5d89c5c63cf41c448cb285f336b43c25205
11371570f0d31553f5759208a0895c4c960925878c065132a2f1478a953e2f74 - 11371570f0d31553f5759208a0895c4c960925878c065132a2f1478a953e2f74
f58500640ad1c877093026ed662da201dd6fe4da94fa8df677ddd16ed24fbdbc - f58500640ad1c877093026ed662da201dd6fe4da94fa8df677ddd16ed24fbdbc
98e1498bf9e7f2fc6747c865b2ecdbb4f79774d919a6f53fa9da04aa0730a1aa - 98e1498bf9e7f2fc6747c865b2ecdbb4f79774d919a6f53fa9da04aa0730a1aa
e83c3cd5cc517473518aae79fe792251a3b109ad82ca07a0cea149deeb5e9da6 - e83c3cd5cc517473518aae79fe792251a3b109ad82ca07a0cea149deeb5e9da6
86fb952978a26c6740d8b928f02cd10f82c91228ca1ee78a857e1c524b453d2d - 86fb952978a26c6740d8b928f02cd10f82c91228ca1ee78a857e1c524b453d2d
3875c0647f723a2e3c513beccc1912b9c311e0b05a73fb2acf0c525a8a3a4fc8 - 3875c0647f723a2e3c513beccc1912b9c311e0b05a73fb2acf0c525a8a3a4fc8
122a93dab66f201b4523560e646f776cbcac0146a97d2bb5880729720980b371 - 122a93dab66f201b4523560e646f776cbcac0146a97d2bb5880729720980b371

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.74.98.198
4.230.171.124
85.210.196.11
20.247.185.124
135.233.95.144
20.184.175.23
74.178.76.54
20.165.94.63
104.18.33.89
118.220.233.131
40.84.85.40
52.110.12.38
52.110.12.19
20.42.73.26
51.104.15.252
172.178.240.163
72.154.7.101
52.148.114.188
52.110.12.14
52.110.12.15

More MSILMamut samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report