MALICIOUS — 3e5ac7b07aad0ac1cf03f34de22eeca807515612d9a5368b3770401626017cda

MALICIOUS — 3e5ac7b07aad0ac1cf03f34de22eeca807515612d9a5368b3770401626017cda is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3e5ac7b07aad0ac1cf03f34de22eeca807515612d9a5368b3770401626017cda
SHA-1: bd11a49d842721a64bf64791090936f3d04da7a4
MD5: 4ddb13434a032c096e0592eb4c5997c7
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 1536:xr7ksAK1jlaep2iZtNl+fjEmqyduL5QCPahNT1IP1bZOYPxC5kdczz/Fm:t7ksbjlntl+fju16wPFnPcA
TLSH: T1253A4CCC1B385398DE39CB25304090EE74696CD8D6B9BF481A0487761478E3FA9BA53D
Submitted as: 3e5ac7b07aad0ac1cf03f34de22eeca807515612d9a5368b3770401626017cda
File type: pe · Size: 101376 bytes
Verdict: malicious (100/100) · Family: RedLine

Detections (6 of 56 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Packed.Filerepmalware-9900630-0
Microsoft Defender: PWS:MSIL/RedLine.GG!MTB
Emsisoft (Emergency Kit): IL:Trojan.RedLine.2
Trellix Stinger (McAfee): Trojan-FRAX!4DDB13434A03
Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Packed.Filerepmalware-9900630-0 (rule Win.Packed.Filerepmalware-9900630-0) - engine signal, weight 0.90, confidence 0.95
Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged PWS:MSIL/RedLine.GG!MTB (rule PWS:MSIL/RedLine.GG!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged IL:Trojan.RedLine.2 (rule IL:Trojan.RedLine.2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FRAX!4DDB13434A03 (rule Trojan-FRAX!4DDB13434A03) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Spy.MSIL.Stealer.gen (rule HEUR:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://api.ip.sb/ip - static signal, weight 0.35, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5668) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://api.ip.sb/ip
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

api.ip.sb

Embedded IP addresses

184.84.165.168
4.207.44.67
52.123.252.215
4.230.171.124
20.42.179.204
52.253.84.76
40.79.141.155
20.165.94.54
74.179.77.204
20.184.175.20
135.233.95.144
135.234.160.244
162.159.142.9
52.110.12.51

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report