MALICIOUS — 079b7cff4a4669c43dfc7a6cae41184861e815a5be5bd9913e9489e8dd3aa254

MALICIOUS — 079b7cff4a4669c43dfc7a6cae41184861e815a5be5bd9913e9489e8dd3aa254 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 079b7cff4a4669c43dfc7a6cae41184861e815a5be5bd9913e9489e8dd3aa254
SHA-1: 2ee83ee71ca65df21033313b87f1249c47704664
MD5: 93c299352eb090674ecbfdfcff3f19f9
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:Uyt+1Y0hozFwPdSe1zF7beU40YwkmZ/yW:UbO0UIH7f49O
TLSH: T16347EDCD83B86D50C8ACC13A0A7D9E9B45FBB62C55B73B3D0B2848354E64A770D211B6
Submitted as: 079b7cff4a4669c43dfc7a6cae41184861e815a5be5bd9913e9489e8dd3aa254
File type: pe · Size: 322456 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:MSIL/AgentTesla.LJB!MTB
Trellix Stinger (McAfee): AgentTesla-FDDZ!93C299352EB0
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.LJB!MTB (rule Trojan:MSIL/AgentTesla.LJB!MTB) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!93C299352EB0 (rule AgentTesla-FDDZ!93C299352EB0) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5830 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

9873d0a4cde5773a1a63d66a18b60e70904424b8a972f59da7adfa73d36c03ba - 9873d0a4cde5773a1a63d66a18b60e70904424b8a972f59da7adfa73d36c03ba

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.178.17.234
172.215.188.225
52.230.60.54
52.123.252.227
4.230.171.124
4.247.188.224
74.179.77.204
20.165.94.54
4.150.223.109
51.132.193.105
185.215.113.205
52.110.12.4
51.105.71.137
52.110.12.26
92.223.78.30
20.42.179.192
135.233.45.221
125.56.205.24
125.56.205.51
72.154.7.104
52.148.114.188
52.110.12.44
52.110.12.49

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report