MALICIOUS — bbb4228eb01c37cc7b94f0614a1bfabc30d7e716a97e05e7070a5220b6b71803

MALICIOUS — bbb4228eb01c37cc7b94f0614a1bfabc30d7e716a97e05e7070a5220b6b71803 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Remcos family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: bbb4228eb01c37cc7b94f0614a1bfabc30d7e716a97e05e7070a5220b6b71803
• SHA-1: 01c4656da3049ab70460d4ae92aedc059c2da9b9
• MD5: b9ec739e19bd20471ce15462f0828e81
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 24576:v5CtU57gDojWBpQP5iNWQXfZaGqcodg/:xCi57gUjWBpQBipBoG
• TLSH: T1DA556C2BCB595D1ACCFCF4292C62D0BE9AE6688B243F141047C77439505B3AB4B3257A
• Submitted as: bbb4228eb01c37cc7b94f0614a1bfabc30d7e716a97e05e7070a5220b6b71803
• File type: pe · Size: 1309696 bytes
• Verdict: malicious (89/100) · Family: Remcos

Detections (5 of 52 engines)

• ClamAV (daily): Win.Dropper.Remcos-10026421-0
• Microsoft Defender: Trojan:MSIL/AgentTesla.DLM!MTB
• Emsisoft (Emergency Kit): Trojan.Agent
• Trellix Stinger (McAfee): AgentTesla-FDFG!B9EC739E19BD
• Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView

Embedded domains

• www.codeproject.com

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report