MALICIOUS — f820472e72ddbf6ca61e2a3bd01423a2fc42fee91186a1f75648a9ab61349103

MALICIOUS — f820472e72ddbf6ca61e2a3bd01423a2fc42fee91186a1f75648a9ab61349103 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 8 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: f820472e72ddbf6ca61e2a3bd01423a2fc42fee91186a1f75648a9ab61349103
SHA-1: 5d693fe3e0c7d04c87de9b1e48dc2a39c684a412
MD5: c7b45c26d878dac89cfa5a360d7bff06
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:LrqMdmBt9T27oN0YFa1I+JkICMX5vkOXy:e9TUoN0Eay+SICMG
TLSH: T1F146C0480A635E84FDF2555B6EC0A82E7E07C39938FC8798B55B853D697F13B9201223
Submitted as: f820472e72ddbf6ca61e2a3bd01423a2fc42fee91186a1f75648a9ab61349103
File type: pe · Size: 311808 bytes
Verdict: malicious (100/100) · Family: AgentTesla

Detections (8 of 56 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:L2TUBIuc
YARA: InQuest Labs: AgentTesla
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.MSILPerseus.202938
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
YARA: InQuest Labs flagged AgentTesla (rule AgentTesla) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.MSILPerseus.202938 (rule Gen:Variant.MSILPerseus.202938) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:L2TUBIuc (rule high-entropy-sections:L2TUBIuc) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:L2TUBIuc, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4179 behavior events · 2 ATT&CK techniques · 8 dropped files.

Dropped files

97f3cd23bd5c5d462a5f7ed7dc1207503013a1258d334487b4d09599989126f9 - 97f3cd23bd5c5d462a5f7ed7dc1207503013a1258d334487b4d09599989126f9
97d85a77291ae91fe3a223b793e581d4bae9671b2e0a8c39745aaceb2505b06c - 97d85a77291ae91fe3a223b793e581d4bae9671b2e0a8c39745aaceb2505b06c
c8ce80e6fb268afe83287bf40c59e2a9b37da5fa6a4bc8dcc3801fb96d673b9f - c8ce80e6fb268afe83287bf40c59e2a9b37da5fa6a4bc8dcc3801fb96d673b9f
97bc291b4839403432cee520486fe4788e1f8a23e98f88fd65b61ad7f113e919 - 97bc291b4839403432cee520486fe4788e1f8a23e98f88fd65b61ad7f113e919
bf3c0c703d11fc24f84918a6d12c865477fcb25dac2801f44dc4e50dfd1a40a3 - bf3c0c703d11fc24f84918a6d12c865477fcb25dac2801f44dc4e50dfd1a40a3
e8307cf1df4796370895cb7e40bc0e8b0eec7e0198a286291224c3d38ad90bdd - e8307cf1df4796370895cb7e40bc0e8b0eec7e0198a286291224c3d38ad90bdd
bee313b6f82b4046543850f57dd3cf4781d74cdc747e5f097364ad19d7f1b262 - bee313b6f82b4046543850f57dd3cf4781d74cdc747e5f097364ad19d7f1b262
e4765947b03322e3e20b612c214bb40c396668f3247839f76a0ccfc0cc7c34e3 - e4765947b03322e3e20b612c214bb40c396668f3247839f76a0ccfc0cc7c34e3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

104.46.162.224
20.247.185.124
52.123.252.227
4.230.171.124
172.64.154.167
52.110.12.47
52.110.12.24
20.42.179.192
52.110.12.22
52.110.12.46
52.148.114.188
72.145.35.105

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report