MALICIOUS — 17f7addf49e984c6d227b9b84fdbe61aa0474a8a8a0e67fc8dddded3a6ddac4c

MALICIOUS — 17f7addf49e984c6d227b9b84fdbe61aa0474a8a8a0e67fc8dddded3a6ddac4c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the RedLineStealer family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 17f7addf49e984c6d227b9b84fdbe61aa0474a8a8a0e67fc8dddded3a6ddac4c
SHA-1: 78534993244ff13ca6838c0264ec0284873236e3
MD5: 40f10c6c8f1ca5698695ad215905e95e
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 3072:B1k81xkwsz7KWulTCvRaFoBV8ntLbHaL6pr7afKXmRdFSi5uDO8N13B1WZQGSof:fr5TCv5qHnkfKUz5uq8P3OZU
TLSH: T14E437D8A14921E23D4B865762D7BC0AE718EDA8FF5FDAE950B303061391EE3714243D6
Submitted as: 17f7addf49e984c6d227b9b84fdbe61aa0474a8a8a0e67fc8dddded3a6ddac4c
File type: pe · Size: 222952 bytes
Verdict: malicious (98/100) · Family: RedLineStealer

Detections (4 of 56 engines)

capa (capabilities): capability:execution/powershell
Microsoft Defender: Trojan:MSIL/RedLineStealer.MAK!MTB
Emsisoft (Emergency Kit): Generic.Dacic.F96EFD6C.A.DBBEC73F
Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_ce5a71cdb3 (pid 7856) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:MSIL/RedLineStealer.MAK!MTB (rule Trojan:MSIL/RedLineStealer.MAK!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.F96EFD6C.A.DBBEC73F (rule Generic.Dacic.F96EFD6C.A.DBBEC73F) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Spy.MSIL.Stealer.gen (rule HEUR:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1091 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

743abad359a5bd524c55b5611f638990220f077e4bb34846aeb850bb76b16368 - 743abad359a5bd524c55b5611f638990220f077e4bb34846aeb850bb76b16368
b3d36b37ac0a528054ec06ba7b526e3ea7c5a53c6e6df4ee7f2a57a0a9cb3955 - b3d36b37ac0a528054ec06ba7b526e3ea7c5a53c6e6df4ee7f2a57a0a9cb3955

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.104
4.230.171.124
20.42.179.192
52.253.84.76
135.233.95.144
74.178.240.51
4.150.223.114
20.165.94.63
20.184.175.5
77.246.159.59
172.215.188.225
52.110.12.31
52.110.12.40
125.56.205.32
125.56.205.42
4.150.223.106
20.42.73.31
72.145.35.98
52.148.114.188
52.110.12.30
52.110.12.4

More RedLineStealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report