MALICIOUS — bfda36d3ebc1fb857cb54351080065ade276dc8f3a4123642c733f9b46ff89c0

MALICIOUS — bfda36d3ebc1fb857cb54351080065ade276dc8f3a4123642c733f9b46ff89c0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Remcos family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: bfda36d3ebc1fb857cb54351080065ade276dc8f3a4123642c733f9b46ff89c0
SHA-1: 01562ed1b8d6ab5e467008a1f545c785b8bbc436
MD5: 609d401e53e8dd8651a9e36619d155db
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 24576:yQNx8kZVGS/+SZOggBKx7a5NwMXmd/9lueO/3+iPDHi:LZsSGOOggBKx7aTwMXUueOv+
TLSH: T1FD556CABCB595D1ACCFC34385D3AD1AE2EE66847243F15040787B43A11272AB4B2257F
Submitted as: bfda36d3ebc1fb857cb54351080065ade276dc8f3a4123642c733f9b46ff89c0
File type: pe · Size: 1244160 bytes
Verdict: malicious (98/100) · Family: Remcos

Detections (5 of 55 engines)

ClamAV (daily): Win.Dropper.Remcos-10026421-0
Microsoft Defender: Trojan:MSIL/AgentTesla.DLM!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDFG!609D401E53E8
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10984 behavior events · 2 ATT&CK techniques · 17 dropped files.

Dropped files

022d3c6d81f60a1fef9d1c014fca63ab8772cc82463949134ad88bf2b16c04a1 - 022d3c6d81f60a1fef9d1c014fca63ab8772cc82463949134ad88bf2b16c04a1
a36284a46cea0a820d39e13be8fde78973baed3ddb38bd42732cf04042f8517c - a36284a46cea0a820d39e13be8fde78973baed3ddb38bd42732cf04042f8517c
0a5177819b0e5629610df0ef2858ec3e717bf562e4abf74b1cc02ae7ad6fe178 - 0a5177819b0e5629610df0ef2858ec3e717bf562e4abf74b1cc02ae7ad6fe178
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f - 86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
cf982f43775b6561bcecd51f3433d4ff1ca1818ed18e1ab64b42d08b0fec3880 - cf982f43775b6561bcecd51f3433d4ff1ca1818ed18e1ab64b42d08b0fec3880
5fa372d46497d85662202cdc8132578b341d3d9de6ec40803a4f366d8422ed5c - 5fa372d46497d85662202cdc8132578b341d3d9de6ec40803a4f366d8422ed5c
1500253a891adc6bf9379fd2b7b8e7e12467099ded06f5607eecb4c602a7d454 - 1500253a891adc6bf9379fd2b7b8e7e12467099ded06f5607eecb4c602a7d454
a55e565573e3c0f2139282378791aa2e09dbb3c6410ef5812b95b282a14c0f85 - a55e565573e3c0f2139282378791aa2e09dbb3c6410ef5812b95b282a14c0f85
004c0a0c1d9823ade0ea6fed3ec7ae38ea6f0932279be0878c6c2910edc7162b - 004c0a0c1d9823ade0ea6fed3ec7ae38ea6f0932279be0878c6c2910edc7162b
77017b43933ed9605a22f5acc5e023edb1e9fbb59eefa470c700260783b9c3b6 - 77017b43933ed9605a22f5acc5e023edb1e9fbb59eefa470c700260783b9c3b6
64d8f1f02b9d3e37b50220cbe98ddbdf2232abee40bbb12294ac164e859703f5 - 64d8f1f02b9d3e37b50220cbe98ddbdf2232abee40bbb12294ac164e859703f5
8cf9ead3732be538b568c353ec37ac95402dec67ebdba805bcebab7b2f6e60ec - 8cf9ead3732be538b568c353ec37ac95402dec67ebdba805bcebab7b2f6e60ec
b337844e38660b377abba55d35534d64ed07348da4c522d9333535624b225cd5 - b337844e38660b377abba55d35534d64ed07348da4c522d9333535624b225cd5
a1ed566db940c3ec18c927d6f6649628ca49a845175c64fd2429577f31771eb3 - a1ed566db940c3ec18c927d6f6649628ca49a845175c64fd2429577f31771eb3
953da38e01fe4b1af994c903ed0a4c25e3a9ea2ec70d7002d6f10aa516077f0c - 953da38e01fe4b1af994c903ed0a4c25e3a9ea2ec70d7002d6f10aa516077f0c

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787881890&P2=404&P3=2&P4=MYemMXCdvctaTqEPMNM%2fJ9RbsTGYM7rbNe2xVdDVDuhnrMpnN0ZpWEkYDzWdDjMyRIf5KhayyI76FQwjKUreAw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787881939&P2=404&P3=2&P4=i1%2fDgmY77csI3BsByiJjGfiTbZM2KR8dEX5r%2fC4B1S4ykMKZfEs%2fM5pLpRj12NCxIb11JCxiUwn34XWTqmnoXg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

www.codeproject.com

Embedded IP addresses

52.182.143.212
57.155.101.212
4.230.171.124
52.230.60.54
135.232.92.137
74.178.76.54
20.231.239.246
52.123.128.14
20.184.175.19
20.184.175.13
203.26.79.13
135.234.160.245
52.110.12.55
52.110.12.22
135.233.95.80
52.148.114.188
72.145.35.97
92.223.78.30
20.42.179.204
4.247.188.224
52.110.12.56
52.110.12.16

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report