MALICIOUS — b8ad21d249a0b8ba32ceceed65c4fb193601704445f5c5b11e4ed41394c60749

MALICIOUS — b8ad21d249a0b8ba32ceceed65c4fb193601704445f5c5b11e4ed41394c60749 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Filerepmalware family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: b8ad21d249a0b8ba32ceceed65c4fb193601704445f5c5b11e4ed41394c60749
• SHA-1: c16522ce638ec5f52043395ec62f847d804e8a17
• MD5: 01c5d90f9b5c274231d2c9949db0e3a4
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 6144:bDsmwheMKMshq8/ML8Tv33onH73BItiKqL/Wzxl92pJSoqHaNyzv1GrjhcS1qN6:/whePldMLs/4nb3BWQoz+FatD4rjuYq
• TLSH: T12E4812C538BCC813CAFB7D5A7BB474DC0FE905C9D5991B48A2104635922C963A8C93AB
• Submitted as: b8ad21d249a0b8ba32ceceed65c4fb193601704445f5c5b11e4ed41394c60749
• File type: pe · Size: 363008 bytes
• Verdict: malicious (100/100) · Family: Filerepmalware

Detections (6 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Packed.Filerepmalware-9908276-0
• Microsoft Defender: Trojan:MSIL/AgentTesla.DKM!MTB
• Emsisoft (Emergency Kit): Trojan.Crypt
• Trellix Stinger (McAfee): PWS-FCUF!01C5D90F9B5C
• Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Noon.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Packed.Filerepmalware-9908276-0 (rule Win.Packed.Filerepmalware-9908276-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:MSIL/AgentTesla.DKM!MTB (rule Trojan:MSIL/AgentTesla.DKM!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged PWS-FCUF!01C5D90F9B5C (rule PWS-FCUF!01C5D90F9B5C) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Spy.MSIL.Noon.gen (rule HEUR:Trojan-Spy.MSIL.Noon.gen) - engine signal, weight 0.55, confidence 0.85
• Contacted 11 external host(s) and 10 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Extracted Formbook config (0 C2) - engine signal, weight 0.45, confidence 0.60
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

8305 behavior events · 1 ATT&CK techniques · 9 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 76.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• update.googleapis.com
• desktop-hsgcbep
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 251.0.0.224.in-addr.arpa
• 1.0.240.10.in-addr.arpa

Dropped files

• 756cb41e1f04aae1c6783e7c3f8911cb6dc08f7fe9dcd360d329d04883b58a1a - 756cb41e1f04aae1c6783e7c3f8911cb6dc08f7fe9dcd360d329d04883b58a1a
• 91655863c7906a8d20c7c782144f553c027843a72f2fdab2b1ccc80808083af0 - 91655863c7906a8d20c7c782144f553c027843a72f2fdab2b1ccc80808083af0
• 1c975e99378d664b8183a4f2c5824f3b3524770b1df0618b095b8bc02c41c6d7 - 1c975e99378d664b8183a4f2c5824f3b3524770b1df0618b095b8bc02c41c6d7
• 1d330455a242dde1b6f41698c623d11076735d1034fd594b0a3ce858a5044fab - 1d330455a242dde1b6f41698c623d11076735d1034fd594b0a3ce858a5044fab
• 1c2e00f4b3e5f7477d5f92aaf1b5f4d5a54fe38380f4d4d79f402efe0f6c1a84 - 1c2e00f4b3e5f7477d5f92aaf1b5f4d5a54fe38380f4d4d79f402efe0f6c1a84
• 24b55cc00a7c45e45d14d2db80ea83488f31d5716f3832ea040cfd0123281d8a - 24b55cc00a7c45e45d14d2db80ea83488f31d5716f3832ea040cfd0123281d8a
• 10635983a27b91107ec25819af475debdad0864da1a73b3cc1b46b4b6e02ea1a - 10635983a27b91107ec25819af475debdad0864da1a73b3cc1b46b4b6e02ea1a
• e6dd31f47d82bf312a91cfd147ea9ff9ab7cf4e79c13e2db5ed03d82b2676fa0 - e6dd31f47d82bf312a91cfd147ea9ff9ab7cf4e79c13e2db5ed03d82b2676fa0
• 811e7c9d8c2e12699f2f7a6682ca127359f2f7999453dd7c5358036f36b70a25 - 811e7c9d8c2e12699f2f7a6682ca127359f2f7999453dd7c5358036f36b70a25

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.50.73.5
• 48.211.4.16
• 4.150.223.108
• 4.150.223.113
• 74.178.232.29
• 52.148.114.188
• 72.154.7.108
• 72.145.35.97
• 4.150.223.109
• 52.168.112.66
• 20.50.201.195
• 172.172.255.217
• 20.42.65.89
• 4.144.132.223
• 52.110.12.53
• 4.230.171.124
• 20.89.1.12
• 20.42.179.192

More Filerepmalware samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report