MALICIOUS — 51af9f180b19c1fde2d41a39f6e5199124feb82e0b6f140b1a7d3a43009d5ad7

MALICIOUS — 51af9f180b19c1fde2d41a39f6e5199124feb82e0b6f140b1a7d3a43009d5ad7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 51af9f180b19c1fde2d41a39f6e5199124feb82e0b6f140b1a7d3a43009d5ad7
SHA-1: ebc2129df1bf3f70e8d87a3ad7d712cb7cfa83bd
MD5: f3a19cd87663718630eed3db8ff4a3be
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:1GsmmI9NHcx7Vfs+7yeD38+NuJeroQ5l5FwPdDwKzPaLAT2m9:Jmmod8Vfs+77T8OuEsql52Pd1PaLAT59
TLSH: T1B647FDDE86B91D54C4EC802D127F5E5F46CBF46957B17B8E2E2840314AD6B332D232A2
Submitted as: 51af9f180b19c1fde2d41a39f6e5199124feb82e0b6f140b1a7d3a43009d5ad7
File type: pe · Size: 331160 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:MSIL/AgentTesla.LJB!MTB
Trellix Stinger (McAfee): AgentTesla-FDDZ!F3A19CD87663
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.LJB!MTB (rule Trojan:MSIL/AgentTesla.LJB!MTB) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!F3A19CD87663 (rule AgentTesla-FDDZ!F3A19CD87663) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 3 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5835 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

273723d19b76fc2ae6a621efb6bec836490ab29c0b42b15cfb3b79316d4fa44e - 273723d19b76fc2ae6a621efb6bec836490ab29c0b42b15cfb3b79316d4fa44e

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.109
52.123.252.218
20.42.179.192
135.232.92.97
4.230.171.124
20.42.73.28
74.178.240.61
20.247.184.142
52.123.252.204
74.179.77.204
52.110.12.2
94.26.230.203
52.110.12.16
52.148.114.188
72.145.35.102
52.110.12.30
52.110.12.31

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report