MALICIOUS — 375b7e7b28eba803b53a4bbc2c8a10910fab673d0274d25d4f328f32ad17b62e
MALICIOUS — 375b7e7b28eba803b53a4bbc2c8a10910fab673d0274d25d4f328f32ad17b62e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the RedLine family. 4 of 55 detection engines flagged it.
Identification
- SHA-256:
375b7e7b28eba803b53a4bbc2c8a10910fab673d0274d25d4f328f32ad17b62e - SHA-1:
59bb958faa93750fb8dcb8282e6c1008db31b010 - MD5:
2aea756079757c6c6924ae3137d0cfb5 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
6144:8S0HusuSzw58VamFP03layN+wBdsJIl1ZjFf4GPdKuvd3wupJ6C:Fsp08VFPqZZCGPdKuvhj - TLSH:
T183482F9FA2DD1D52C8FC103A027E7C8B86CB44AD9472315F6D7C08715AA863F45227BA - Submitted as: 375b7e7b28eba803b53a4bbc2c8a10910fab673d0274d25d4f328f32ad17b62e
- File type: pe · Size: 381336 bytes
- Verdict: malicious (89/100) · Family: RedLine
Detections (4 of 55 engines)
- LIEF (executable format parser): lief:invalid-authenticode
- Emsisoft (Emergency Kit): Trojan.Agent
- Trellix Stinger (McAfee): AgentTesla-FDDZ!2AEA75607975
- Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen
Why this verdict
The malicious score of 89/100 is the fusion of 4 weighted signals:
- Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 9.28.45.4 - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1405 behavior events · 0 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
Dropped files
- 5aa72a9d5dd1c9280727f62da22ebe55cb279a837f425f69155a8cd183b918e8 -
5aa72a9d5dd1c9280727f62da22ebe55cb279a837f425f69155a8cd183b918e8 - 41667a99ebb7557c6f45bbd43fe32e43d9d34b687c25a6f0a590b3f8eb0cd819 -
41667a99ebb7557c6f45bbd43fe32e43d9d34b687c25a6f0a590b3f8eb0cd819 - 2c43e37ec86c425120a0fdc424235dcc415450a9e8afad8b58fac4419d0876fd -
2c43e37ec86c425120a0fdc424235dcc415450a9e8afad8b58fac4419d0876fd - ba75e281688c48f0c16e337ed06a9bcb83905858461caeb7a93bdfe12a2fe6dc -
ba75e281688c48f0c16e337ed06a9bcb83905858461caeb7a93bdfe12a2fe6dc - 7ae747bd7f5e95ddb02a4faac7c9196915fc4d1e00c8d02d25b512fdf7bf2378 -
7ae747bd7f5e95ddb02a4faac7c9196915fc4d1e00c8d02d25b512fdf7bf2378 - 5a23c7d07e51a11171f1ad6df09dac3faec0befe3a4aea39d480c45fcf7077bc -
5a23c7d07e51a11171f1ad6df09dac3faec0befe3a4aea39d480c45fcf7077bc - 1480fe7ef03bce75f8f5d45d954995114ebe2347dd20ead9514ded479f6362c8 -
1480fe7ef03bce75f8f5d45d954995114ebe2347dd20ead9514ded479f6362c8 - 188c56d3268a5a86574464b4ca29e3772e51911d618b60c0c53f9bcec6ab3a37 -
188c56d3268a5a86574464b4ca29e3772e51911d618b60c0c53f9bcec6ab3a37 - 9e7c0af9e450fcc5faa6df3227eae08da54edb9e1c1e516b183261784cad3c15 -
9e7c0af9e450fcc5faa6df3227eae08da54edb9e1c1e516b183261784cad3c15 - 12b9c9a31324cdef7a65963955e45f925d4eb0db0acf8c4ba1428ab20d8c6898 -
12b9c9a31324cdef7a65963955e45f925d4eb0db0acf8c4ba1428ab20d8c6898 - 155b7dd3953a6d088758adce00484e0827828323aecebf4633ee2f9f944206fe -
155b7dd3953a6d088758adce00484e0827828323aecebf4633ee2f9f944206fe - 058936b20f567eb04f8bc7d302723dfa7ca27bc6db4d1096df491b71e8c215ed -
058936b20f567eb04f8bc7d302723dfa7ca27bc6db4d1096df491b71e8c215ed - 7cfba7cbaea634f404cdd4eb471bfb4de619b75b98d3ccf280852505a867bfd2 -
7cfba7cbaea634f404cdd4eb471bfb4de619b75b98d3ccf280852505a867bfd2 - 5d56c873dd2abe1f711a9286ad70dd6e427b5eb36c0ae9c3d88b2b0a529782e0 -
5d56c873dd2abe1f711a9286ad70dd6e427b5eb36c0ae9c3d88b2b0a529782e0 - c2a47f955a1677fb15b6a34c1777ee525c760b644898be9bf16e9878b8faec34 -
c2a47f955a1677fb15b6a34c1777ee525c760b644898be9bf16e9878b8faec34
Embedded URLs
- http://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- https://www.digicert.com/CPS0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787845282&P2=404&P3=2&P4=jqHgnn8hWNTEYw86dEF2zfBDO2zq7f6gO96ApYJ%2bKNRKqpWp%2byiSJvOVDqRirtsxF5je8zK8uBwrjQVXC4mo9A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787845347&P2=404&P3=2&P4=nuzRJOB3lzffWrpr%2bMJOORSST1ScQNLBOyHzK6ifsjPYnh7%2bzkk50%2fiMnGMHPwrA0jfa3a8%2fZtpVXvLvryVeUw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.digicert.com
- crl3.digicert.com
- crl4.digicert.com
- cacerts.digicert.com
Embedded IP addresses
- 9.28.45.4
- 20.89.1.13
- 4.247.188.233
- 4.230.171.124
- 20.247.184.197
- 4.144.132.114
- 20.165.94.63
- 135.233.95.135
- 4.207.44.76
- 135.232.92.137
- 92.223.78.30
- 52.123.128.14
- 20.76.201.171
- 52.123.129.14
- 20.184.175.23
- 135.233.45.222
- 172.66.2.5
- 185.215.113.109
- 203.26.79.13
- 52.110.12.44
- 52.148.114.188
- 52.110.12.45
- 52.123.252.202
- 135.233.95.80
- 4.150.223.104
More RedLine samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report