MALICIOUS — ff4bc4e5404cf64b4fa06f5764c980dd9ca7be7a041dd7a7ae1f4e59f498676a

MALICIOUS — ff4bc4e5404cf64b4fa06f5764c980dd9ca7be7a041dd7a7ae1f4e59f498676a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Agensla family. 3 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: ff4bc4e5404cf64b4fa06f5764c980dd9ca7be7a041dd7a7ae1f4e59f498676a
SHA-1: 35eab287582393093badbd89c27b020b767c0555
MD5: 6508d8f2b6db184a46b27170b23292ad
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:0vJ0XBzHuLH9tMoZiEEJOM0XnoPX5f4xTBg:xhHuLjMoZiEEJOMzPX5f4xTBg
TLSH: T14D4FAE8919392B6DE2F135B2249496FEED5B6D8E38B47EC006D0AC31363DB3B8035159
Submitted as: ff4bc4e5404cf64b4fa06f5764c980dd9ca7be7a041dd7a7ae1f4e59f498676a
File type: pe · Size: 691200 bytes
Verdict: malicious (100/100) · Family: Agensla

Detections (3 of 56 engines)

Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.Agent
Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. process hollowing in RegSvcs.exe (pid 2916) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
3 behavioral detection(s) across 3 rule(s): Defense Evasion: disable AV / Defender [high] (rule tl-defender-tamper) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-PSW.MSIL.Agensla.gen (rule UDS:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted WarzoneRAT config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

35456 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 82e10a3b46dc874755c8de814cea9bf916f9446dbe35b77ec7ec57543f64797d
C:\Users\analyst\AppData\Local\Temp\tmp8613.tmp - a98b92eb2d9bbdb94345b073412b8bea3a370222bc04e742998f32a648d1afd9
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_1ubyugqn.c5z.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
a9e1e30df25b18c6d1c20d6dde450d58422b9531d6aee46970720150cb81922b - a9e1e30df25b18c6d1c20d6dde450d58422b9531d6aee46970720150cb81922b
2035ce8d98cd3f5374fb470f0aa3ef2f26d0ed7e8e9f97876809fcaf3a1d8b71 - 2035ce8d98cd3f5374fb470f0aa3ef2f26d0ed7e8e9f97876809fcaf3a1d8b71
61a25a71e4a535b17f47edd1f6ebaa8993134017921a93782e498cc244e49ae2 - 61a25a71e4a535b17f47edd1f6ebaa8993134017921a93782e498cc244e49ae2
bb938c29fda72b83d20ea3a983bb406a54b724c7e70289bd64f34aba30bb4311 - bb938c29fda72b83d20ea3a983bb406a54b724c7e70289bd64f34aba30bb4311
8a52582d07a8e9866bab273b70e3253b70bc76aea1bd78c609b1b502ce64d080 - 8a52582d07a8e9866bab273b70e3253b70bc76aea1bd78c609b1b502ce64d080
c5573a901d8ae16876fd293a487aa09a20c296058618a60d789e2fb5a76c7bbd - c5573a901d8ae16876fd293a487aa09a20c296058618a60d789e2fb5a76c7bbd
02f9cf3f505415794d6899d9fa490a5d355e445b575c6c9d17e21be0f1f29b31 - 02f9cf3f505415794d6899d9fa490a5d355e445b575c6c9d17e21be0f1f29b31
325f9d7c6f72abda6e92c742d139a2b4bcccc261ab3b3420a79f64b31981010c - 325f9d7c6f72abda6e92c742d139a2b4bcccc261ab3b3420a79f64b31981010c
b7c0ce9a5f89c65d2843d2c6f38cb0973b8609daf11b9077317b3c4757c0c403 - b7c0ce9a5f89c65d2843d2c6f38cb0973b8609daf11b9077317b3c4757c0c403
9c4fcbd54072be39b64e29efc774996df736be5455b1896bce4f32727ff0e3eb - 9c4fcbd54072be39b64e29efc774996df736be5455b1896bce4f32727ff0e3eb
41d8f9d165a4004a5e1f748190e43ea9cb2c5882ecfa712c265ebab1f3669f1e - 41d8f9d165a4004a5e1f748190e43ea9cb2c5882ecfa712c265ebab1f3669f1e
48f06dece14dd761569a01a4dec146749c79f999aa58a3ba9b10be7dbb414a25 - 48f06dece14dd761569a01a4dec146749c79f999aa58a3ba9b10be7dbb414a25

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.codeproject.com
newmanserverug.ddns.net

Embedded IP addresses

4.150.223.107
20.247.184.197
4.230.171.124
57.155.101.212
135.233.45.223
40.84.85.40
52.110.12.46
52.110.12.2
52.148.114.188
72.145.35.100

More Agensla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report