MALICIOUS — 360978b63f3d8ab7b2d4a91271ac874cd72d499efb7bf8774dce3cb5bf13aafd

MALICIOUS — 360978b63f3d8ab7b2d4a91271ac874cd72d499efb7bf8774dce3cb5bf13aafd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Reline family. 6 of 56 detection engines flagged it.

Identification

SHA-256: 360978b63f3d8ab7b2d4a91271ac874cd72d499efb7bf8774dce3cb5bf13aafd
SHA-1: e62bc3f2fe68098c7401627a4be11938888be54d
MD5: 7f7e5088eaef4dd784a5c91b2fa59c1b
imphash: 4328f7206db519cd4e82283211d98e83
ssdeep: 49152:syKs1MEVwh6Nj2AkmtfXMrDp2+0yTKTfwo5yBA7XMJkv9zHCN9psg6YGF7Ju+QDH:Es1MEz/P+Dp25JfwosEDpHC/v6YmuB
TLSH: T1CD5EF0584F1635FFD0949538641C7D9E394202D2951F9C98C783F13AAAE12F372A22BB
Submitted as: 360978b63f3d8ab7b2d4a91271ac874cd72d499efb7bf8774dce3cb5bf13aafd
File type: pe · Size: 2911960 bytes
Verdict: malicious (100/100) · Family: Reline

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Dropper.Reline-9906719-0
Detect It Easy (packer/type): DIE:wxWidgets
Microsoft Defender: Trojan:Win32/Fimal!rfn
Emsisoft (Emergency Kit): Trojan.Agent
Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.bhpn

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Dropper.Reline-9906719-0 (rule Win.Dropper.Reline-9906719-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Fimal!rfn (rule Trojan:Win32/Fimal!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.Win32.Stealer.bhpn (rule UDS:Trojan-Spy.Win32.Stealer.bhpn) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:wxWidgets (rule DIE:wxWidgets) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,â¬Â®Â°`,.boot,â¬Â®Â°`,â¬Â®Â°`, wxWidgets - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

848 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

096ebe997b3ecf39f84d14243e2e63f87e1cf96765363adbcd24498295f25151 - 096ebe997b3ecf39f84d14243e2e63f87e1cf96765363adbcd24498295f25151
a00ef469f286ce5cb9d55046153c6e669daf682ad2219fc0a3f50dc1f67b7141 - a00ef469f286ce5cb9d55046153c6e669daf682ad2219fc0a3f50dc1f67b7141

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
https://sectigo.com/CPS0D
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

c.xyz
color.xyz
adjacentcolor.xyz
schemas.microsoft.com
sectigo.com
crl.sectigo.com
crt.sectigo.com
crl.usertrust.com
crt.usertrust.com
aefd.nelreports.net

Embedded IP addresses

20.42.72.131
20.247.184.142
4.230.171.124
20.247.184.197
144.202.38.53
172.64.149.23
20.42.179.204
20.52.64.201
72.154.7.100
52.148.114.188
52.110.12.2
52.110.12.46

File paths

M:\9BX

More Reline samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report