MALICIOUS — ba93804dc54b3a8d350bf4c2f4c378e4c146c7a4cd13d40a2ba6b0660001df35

MALICIOUS — ba93804dc54b3a8d350bf4c2f4c378e4c146c7a4cd13d40a2ba6b0660001df35 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: ba93804dc54b3a8d350bf4c2f4c378e4c146c7a4cd13d40a2ba6b0660001df35
SHA-1: 31267857c21c4a91d4fdcb692fbbbef898df52c9
MD5: e1c3134b0ddea4e478e54c66bc5b53a5
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:TEekLt1QYbwRxZxez8jUt5h5R3PLt1e7oKXnz61QIb:itXKxZjUt5ptoz
TLSH: T18A4ED062CFA75D63C4FE79192D2280EF6BD2C80AD42D95905303683A366727B02713B7
Submitted as: ba93804dc54b3a8d350bf4c2f4c378e4c146c7a4cd13d40a2ba6b0660001df35
File type: pe · Size: 656896 bytes
Verdict: malicious (100/100) · Family: AgentTesla

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.LokiBot-10027028-0
Microsoft Defender: Trojan:MSIL/Tnega.KA!MTB
Emsisoft (Emergency Kit): Trojan.Packed
Trellix Stinger (McAfee): AgentTesla-FDFG!E1C3134B0DDE
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Packed.LokiBot-10027028-0 (rule Win.Packed.LokiBot-10027028-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Defense Evasion: disable AV / Defender [high] (rule tl-defender-tamper) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/Tnega.KA!MTB (rule Trojan:MSIL/Tnega.KA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Packed (rule Trojan.Packed) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFG!E1C3134B0DDE (rule AgentTesla-FDFG!E1C3134B0DDE) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Formbook config (0 C2) - engine signal, weight 0.45, confidence 0.60
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hollowing in WWAHost.exe (pid 7504) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

17822 behavior events · 1 ATT&CK techniques · 23 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 37b71f4de060e59e43f15acc05b93b06e7c5e168557873c6bb711255915b9542
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_4yj0bx00.oka.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Temp\tmpFCAA.tmp - 2efdb0d4ec67862353debf46c3870f68ccd3b16d07c609cdab9e2625028617d6
6b123b8106e7fa0a133f228c1a4c844ca2666f2b0776578b1a7db4c98264a132 - 6b123b8106e7fa0a133f228c1a4c844ca2666f2b0776578b1a7db4c98264a132
d5e83c2c02fe4ef35739b99e6229f7963d31fe83888efbefce453bcabe884990 - d5e83c2c02fe4ef35739b99e6229f7963d31fe83888efbefce453bcabe884990
15fcb9d03ffbc12dfbe0971878b38b7259e6cc36c13c577de925ff4d8561dbba - 15fcb9d03ffbc12dfbe0971878b38b7259e6cc36c13c577de925ff4d8561dbba
4f0c5d54a29d09944a97f9955bfd3879e360967ae6e8bcbf3261ed9512c53fb7 - 4f0c5d54a29d09944a97f9955bfd3879e360967ae6e8bcbf3261ed9512c53fb7
00dc516b805411a32597e9e4694b14eff6de6bf49ddf3641fe788d1d47e38518 - 00dc516b805411a32597e9e4694b14eff6de6bf49ddf3641fe788d1d47e38518
22457a35860e7d5aa592ca378128f6fa73bf7c3d3e7b1821578a90e7c6a1c3c4 - 22457a35860e7d5aa592ca378128f6fa73bf7c3d3e7b1821578a90e7c6a1c3c4
16cb33e37ada13e642c45b99a49236d76c38152d0306b48fbc789b8940afebea - 16cb33e37ada13e642c45b99a49236d76c38152d0306b48fbc789b8940afebea
9af9330b293dbb307c80fe04a27f01a1817ac6f1caa15771f20ae2b3a7cda38d - 9af9330b293dbb307c80fe04a27f01a1817ac6f1caa15771f20ae2b3a7cda38d
c37e5901f2d8e9d498bfe5c5ed8656dd9c22d5165d2b63836a992f476b868302 - c37e5901f2d8e9d498bfe5c5ed8656dd9c22d5165d2b63836a992f476b868302
a32e061536e3d505f77d737c4bc23ab9ae9e34f82bc9ac449b554093c8d4e385 - a32e061536e3d505f77d737c4bc23ab9ae9e34f82bc9ac449b554093c8d4e385
a14206f86861493750fc60b60a954d4a0d27b1887cde1cc067f5a386c102517a - a14206f86861493750fc60b60a954d4a0d27b1887cde1cc067f5a386c102517a
8dfeeecc1b6437eb7eb8e0f35b8c29b709354120e50fc3c46762829fb1f6de31 - 8dfeeecc1b6437eb7eb8e0f35b8c29b709354120e50fc3c46762829fb1f6de31

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
www.palncakeswap.com

Embedded IP addresses

20.42.65.93
52.123.252.220
4.230.171.124
85.210.193.152
74.178.240.51
20.165.94.63
40.79.141.155
52.253.84.76
52.123.252.223
135.232.92.137
34.104.35.123
48.199.12.1
20.184.175.4
203.26.79.13
172.64.154.167
52.148.114.188
52.110.12.10
52.110.12.11
72.153.5.62
92.223.78.30

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report