MALICIOUS — a071e75ffb5eede67e904c8bc96f4c01a36d4ed435e9443671473dc4a167a8f1

MALICIOUS — a071e75ffb5eede67e904c8bc96f4c01a36d4ed435e9443671473dc4a167a8f1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the AgentTesla family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: a071e75ffb5eede67e904c8bc96f4c01a36d4ed435e9443671473dc4a167a8f1
SHA-1: 4b451151d9679856cd86eb83c74df8ee9e5b60d8
MD5: 3db0db60909e8905855748427dde8d3c
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:EekrZ/IM58SXkrFvbbaur/T+s/4BCE7TA4y:En9npkrFvnFr/Tx/4EEPAt
TLSH: T1354723DF827C5F10C4BC92B9477E9C8F4AEB74199931392E4D2809305A6853B1FE31A6
Submitted as: a071e75ffb5eede67e904c8bc96f4c01a36d4ed435e9443671473dc4a167a8f1
File type: pe · Size: 339864 bytes
Verdict: malicious (98/100) · Family: AgentTesla

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:MSIL/AgentTesla.LJB!MTB
Trellix Stinger (McAfee): AgentTesla-FDDZ!3DB0DB60909E
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

Microsoft Defender flagged Trojan:MSIL/AgentTesla.LJB!MTB (rule Trojan:MSIL/AgentTesla.LJB!MTB) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!3DB0DB60909E (rule AgentTesla-FDDZ!3DB0DB60909E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

7400 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

18988ae3721a0e363d1897d0147ec91d76c25c9ee783bf7ad279d1582f8fee42 - 18988ae3721a0e363d1897d0147ec91d76c25c9ee783bf7ad279d1582f8fee42

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.144.132.114
4.150.223.112
4.230.171.124
172.64.154.167
91.243.32.23
162.159.142.9
4.150.223.107
51.116.246.105
135.234.160.244
40.84.85.40
20.42.179.192
52.110.12.50
52.110.12.25
52.148.114.188
72.154.7.108

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report