MALICIOUS — fac8504e0f4e3324b1d48f875ed0822756a2d375c37ac1ab62d23889e8eac352

MALICIOUS — fac8504e0f4e3324b1d48f875ed0822756a2d375c37ac1ab62d23889e8eac352 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 10 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: fac8504e0f4e3324b1d48f875ed0822756a2d375c37ac1ab62d23889e8eac352
SHA-1: 8cd133b6b0366539d985d6bfb302b330c34b1c8b
MD5: f32492dac401d94e421a02b4ffc58b60
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 49152:V9ijgQO1PMDozYAPz2UN33BtqV+4rOd1gGYgi2T5h41DTUXjMgGhg+X2ti1m+tw:VRMDoMu28W
TLSH: T18B6712789967BB47DD3CF5344A014D6F10E66C96A638088C67978ABDE3FACB35220170
Submitted as: fac8504e0f4e3324b1d48f875ed0822756a2d375c37ac1ab62d23889e8eac352
File type: pe · Size: 6976000 bytes
Verdict: malicious (100/100) · Family: AgentTesla

Detections (10 of 55 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Packed.Barys-9875294-0
YARA: bartblaze: BB_Clipbanker
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: ReversingLabs: RL_RedLine_Stealer
YARA: MalwareAnalyser community pack: TL_UPX_Packed
YARA: Yara-Rules community: YR_AntiVM_Sandbox
Microsoft Defender: Trojan:MSIL/AgentTesla!pz
Emsisoft (Emergency Kit): Gen:Variant.Lazy.16241
Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

ClamAV (daily) flagged Win.Packed.Barys-9875294-0 (rule Win.Packed.Barys-9875294-0) - engine signal, weight 0.90, confidence 0.95
YARA: ReversingLabs flagged RL_RedLine_Stealer (rule RL_RedLine_Stealer) - engine signal, weight 0.80, confidence 0.70
Dropped a malicious payload (Donut): JavaUpdate.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in Installer.exe (pid 9100) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
YARA: bartblaze flagged BB_Clipbanker (rule BB_Clipbanker) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:MSIL/AgentTesla!pz (rule Trojan:MSIL/AgentTesla!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Lazy.16241 (rule Gen:Variant.Lazy.16241) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Spy.MSIL.Generic (rule HEUR:Trojan-Spy.MSIL.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule TL_UPX_Packed) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: http://www.angusj.com, 16.8.1.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

35392 behavior events · 1 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ResHacker-RH.exe - aeeac91ca85c59309a8d6f7109a84e1ee6d4817498417373e7c3c93dac7bb1e5
C:\Users\analyst\AppData\Local\Temp\Installer.exe - f6f92927f5a3032e9d044479470f3e8d12cc6987aad70c0bce06541b557ee9dd
C:\Users\analyst\Downloads\JavaUpdate.exe - c2032c8f3c3864e67052df1bdccf984df2cdd5311df82ba580e8fac467210be5
795a36b151ae5d8916730717ed7dcc57ef0e822182c02ba217bb2f44b2c1c30b - 795a36b151ae5d8916730717ed7dcc57ef0e822182c02ba217bb2f44b2c1c30b

Embedded URLs

http://www.angusj.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.angusj.com
ipinfo.io

Embedded IP addresses

16.8.1.0
4.150.223.99
52.250.34.200
4.230.171.124
172.64.154.167
74.178.240.51
48.211.4.16
74.179.77.204
40.79.150.121
20.42.65.94
4.247.188.224
72.154.7.97
52.148.114.188
52.110.12.21
52.110.12.3

File paths

X:\:`:d:h:l:p:t:x:
X:\:l:}:
P:\:d:u:
X:\:l:{:
M:\:
C:\Users\Max70\Desktop\files

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report