MALICIOUS — 3a7321df79658446fa25fcc666664a34179d047fe9aa0a696015e957b19f25ac

MALICIOUS — 3a7321df79658446fa25fcc666664a34179d047fe9aa0a696015e957b19f25ac is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3a7321df79658446fa25fcc666664a34179d047fe9aa0a696015e957b19f25ac
SHA-1: 67dea9f027ea346de75e339c02581601b227c110
MD5: e0fe2bb34f9a735f637c7a8225825fdf
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:8NbRUlyODAx+eQYynkOdb6YgBFPn991Bsesz95IaMDemtsoN810cTZ:8Zmbrk+6T5BsniA3Z
TLSH: T12847FB9BD3B92C52CEEC101E027E2DEBCBCB50EE5973311B092905754E9867729212E7
Submitted as: 3a7321df79658446fa25fcc666664a34179d047fe9aa0a696015e957b19f25ac
File type: pe · Size: 327576 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:MSIL/AgentTesla.LJB!MTB
Trellix Stinger (McAfee): AgentTesla-FDDZ!E0FE2BB34F9A
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.LJB!MTB (rule Trojan:MSIL/AgentTesla.LJB!MTB) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!E0FE2BB34F9A (rule AgentTesla-FDDZ!E0FE2BB34F9A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 7.70.5.10 - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

7992 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

d8f7738753284998358f1a75e4d0be948d60e018f98572700e15a32d45cf880c - d8f7738753284998358f1a75e4d0be948d60e018f98572700e15a32d45cf880c

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
default.exp-tas.com

Embedded IP addresses

7.70.5.10
20.42.72.131
4.230.171.124
4.144.132.114
104.18.33.89
81.91.178.86
135.233.45.221
48.200.63.27
40.79.167.9
203.26.79.13
13.69.109.130
51.104.15.252
172.215.188.225
52.148.114.188
72.145.35.96
172.172.255.216
172.172.255.217
52.110.12.30
52.110.12.26

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report