MALICIOUS — 9b21ddd12ab442996f40e9eaa498cd1a3c17c9f157ca3f173ab742f94bbca33b

MALICIOUS — 9b21ddd12ab442996f40e9eaa498cd1a3c17c9f157ca3f173ab742f94bbca33b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Remcos family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: 9b21ddd12ab442996f40e9eaa498cd1a3c17c9f157ca3f173ab742f94bbca33b
• SHA-1: 7b0b966c9df77bb42b54615df3c73663d82ec0ab
• MD5: 2975e9613839d706936991f7fb15ad2b
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 12288:kLDXk6XTsCSr6xvhHuADieEOn69KD8gHXUzJK7stgRG1l1PqpfIw/8GizaadprM:MdGGEOn6sD8g3Urg/B8G2aaLuskdPpr
• TLSH: T110557C2BCB595E1ACCFC35392C62C0BE1AE56847243F1544C787743A541B2AB4B229FB
• Submitted as: 9b21ddd12ab442996f40e9eaa498cd1a3c17c9f157ca3f173ab742f94bbca33b
• File type: pe · Size: 1252352 bytes
• Verdict: malicious (89/100) · Family: Remcos

Detections (5 of 52 engines)

• ClamAV (daily): Win.Dropper.Remcos-10026421-0
• Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen
• Microsoft Defender: Trojan:MSIL/AgentTesla.PK!MTB
• Emsisoft (Emergency Kit): Trojan.Agent
• Trellix Stinger (McAfee): AgentTesla-FDFG!2975E9613839

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView

Embedded domains

• www.codeproject.com

File paths

• A:\F

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report