MALICIOUS — 3d5699e940a03dcf3d2d26591583709822dffd8cd33ca81b6f4dc329039224cd

MALICIOUS — 3d5699e940a03dcf3d2d26591583709822dffd8cd33ca81b6f4dc329039224cd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3d5699e940a03dcf3d2d26591583709822dffd8cd33ca81b6f4dc329039224cd
SHA-1: eb07d8ddcb574eb66b2deb1f0dddc6368ecf54ab
MD5: d9640598906c207fb025b9656cde49b2
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:FNOyJTqEiPTzjcuaf+fSOT1KrtglRikb7HKw:XOyFYzAuaf+6OTsr2lLH5
TLSH: T11547104E826D6D94C4DC002B037D4C9BC9CB74295AB3B10F19B867BDCA989B3CD251B6
Submitted as: 3d5699e940a03dcf3d2d26591583709822dffd8cd33ca81b6f4dc329039224cd
File type: pe · Size: 334744 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: flagged
Trellix Stinger (McAfee): AgentTesla-FDDZ!D9640598906C
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!D9640598906C (rule AgentTesla-FDDZ!D9640598906C) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 3.5.70.13 - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 5 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

6350 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

83e8a8d9d5c922cbe8764cbd43f5208d14d7c25009a07667e3d95383c754cd76 - 83e8a8d9d5c922cbe8764cbd43f5208d14d7c25009a07667e3d95383c754cd76

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com

Embedded IP addresses

3.5.70.13
20.52.64.200
52.110.12.31
52.110.12.54
4.144.132.223
4.230.171.124
65.108.29.210
135.233.45.222
40.84.97.4
20.42.65.90
20.42.65.88
52.148.114.188
72.153.5.141
52.110.12.10
52.110.12.51

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report