MALICIOUS — 8d993cc504fc39db3eeda4ef24903b5e30aa081d8a751c010d8c759f1db0943b

MALICIOUS — 8d993cc504fc39db3eeda4ef24903b5e30aa081d8a751c010d8c759f1db0943b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pwsx family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8d993cc504fc39db3eeda4ef24903b5e30aa081d8a751c010d8c759f1db0943b
SHA-1: 45be2363349f8b93069ee0cd7197c89e79c56c09
MD5: c7ded57e449212920c73241dcd22f2b1
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 98304:1U3BhUKvDlARLczii8hKNIBFeKpAoVDkMQ26uYEAZVnXlTv:1KB/vDSRLcuFheCFLpvql2fOnXlb
TLSH: T10D60227CCD70D2BFFF7E0B97180256DE367A382C58A4285B000CBB11E91965727716AA
Submitted as: 8d993cc504fc39db3eeda4ef24903b5e30aa081d8a751c010d8c759f1db0943b
File type: pe · Size: 3521440 bytes
Verdict: malicious (100/100) · Family: Pwsx

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections::jLr%*Z
ClamAV (daily): Win.Packed.Pwsx-9908212-0
Microsoft Defender: Trojan:MSIL/AgentTesla!MSR
Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.46651
Kaspersky (KVRT): HEUR:Trojan.MSIL.Gorgon.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Pwsx-9908212-0 (rule Win.Packed.Pwsx-9908212-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:MSIL/AgentTesla!MSR (rule Trojan:MSIL/AgentTesla!MSR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.MSILHeracles.46651 (rule Gen:Variant.MSILHeracles.46651) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Gorgon.gen (rule HEUR:Trojan.MSIL.Gorgon.gen) - engine signal, weight 0.55, confidence 0.85
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 22 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections::jLr%*Z (rule high-entropy-sections::jLr%*Z) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections::jLr%*Z - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

26508 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

64bd43b85b8148a6022392ed0e891c1eaf2b125a93bc86e507fa0e5106e21819 - 64bd43b85b8148a6022392ed0e891c1eaf2b125a93bc86e507fa0e5106e21819

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

o.pl
z.su
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.79.141.154
52.123.252.216
135.232.92.97
48.211.4.16
52.182.143.212
4.230.171.124
74.178.240.61
52.230.60.54
13.89.179.12
4.150.223.107
4.150.223.99
52.110.12.25
52.110.12.38
172.64.154.167
92.223.78.30
172.175.111.170
135.233.45.221
20.42.73.31
85.210.193.152
52.148.114.188
203.26.79.13
72.154.7.107
52.110.12.31

File paths

W:\O{
W:\M

More Pwsx samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report