MALICIOUS — 53851947838fb5641d67e536d5a4be4916c1c95410d550b728004ac9459b48ac
MALICIOUS — 53851947838fb5641d67e536d5a4be4916c1c95410d550b728004ac9459b48ac is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it.
Identification
- SHA-256:
53851947838fb5641d67e536d5a4be4916c1c95410d550b728004ac9459b48ac - SHA-1:
55e8e42f25a7af53ae123f9a6b1cd3b5e8097ae4 - MD5:
c1581b1c5bb435e5e747de728d02a911 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
6144:Vi7tCaPM2Hm03+dQLwa7qO5gg4Ag0UCGddBu6RSw7CZbQ5xtd:wRLPT7yKw5O5axd7u6owmZbk - TLSH:
T13547224E837C5E20CCAD42A9027E1FBBC5CB3A5D5672761A96280D374E946334D231BB - Submitted as: 53851947838fb5641d67e536d5a4be4916c1c95410d550b728004ac9459b48ac
- File type: pe · Size: 350104 bytes
- Verdict: malicious (99/100) · Family: RedLine
Detections (4 of 56 engines)
- LIEF (executable format parser): lief:invalid-authenticode
- Emsisoft (Emergency Kit): Trojan.Agent
- Trellix Stinger (McAfee): AgentTesla-FDDZ!C1581B1C5BB4
- Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in tsk_23b916e6bf (pid 1332) (rule
windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent (rule
Trojan.Agent) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!C1581B1C5BB4 (rule
AgentTesla-FDDZ!C1581B1C5BB4) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule
UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85 - Contacted 3 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 2.0.94.80 - static signal, weight 0.35, confidence 0.60
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
1462 behavior events · 0 ATT&CK techniques · 13 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- www.bing.com
- assets.msn.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- 16b9e7329fad1c4dc3a399858bd9525987efe9f91be26a689486d3ece761f27d -
16b9e7329fad1c4dc3a399858bd9525987efe9f91be26a689486d3ece761f27d - 40c56487f3b70161190ea2b771b66fcabee97e942c6eaf2d00310d90d932454a -
40c56487f3b70161190ea2b771b66fcabee97e942c6eaf2d00310d90d932454a - 296508b197838519e380e3e4885d952f3e861e7c675a7ca7ab0116ccf5b2e3d8 -
296508b197838519e380e3e4885d952f3e861e7c675a7ca7ab0116ccf5b2e3d8 - 14358db3d9e3f848190dae569401701401eab96004cfa916383de99d588f3bfe -
14358db3d9e3f848190dae569401701401eab96004cfa916383de99d588f3bfe - cfd6f3b6ac59fdbe6c0be16c1a57dc6277a4cf2509a388d1335f3dfbdeeaff4f -
cfd6f3b6ac59fdbe6c0be16c1a57dc6277a4cf2509a388d1335f3dfbdeeaff4f - a5f90fc70639dc071956b0ba00cc91984e60d7d9e1a1dd924bcacc930757a917 -
a5f90fc70639dc071956b0ba00cc91984e60d7d9e1a1dd924bcacc930757a917 - aa78ecde6926d84e8414847345c34bec4617d0ad98c89637c8e9bb811187857d -
aa78ecde6926d84e8414847345c34bec4617d0ad98c89637c8e9bb811187857d - 14d2f35e087fb8f14ce7d4e40ea80c223a487e7a09dbed972275e20ae99fcde6 -
14d2f35e087fb8f14ce7d4e40ea80c223a487e7a09dbed972275e20ae99fcde6 - d2fc94a57f2dd015bdb4debb82aada63285b98f4e1a79475c0ada3e41992d11f -
d2fc94a57f2dd015bdb4debb82aada63285b98f4e1a79475c0ada3e41992d11f - 18571f8fca9465a7f80a5baaa55165776f9095d4d6064a46563c5a5589ad1751 -
18571f8fca9465a7f80a5baaa55165776f9095d4d6064a46563c5a5589ad1751 - e1547f2d2da70caa6e4efb0e79f9f9abe0fe3240b08ef0b222d895fff51ce45e -
e1547f2d2da70caa6e4efb0e79f9f9abe0fe3240b08ef0b222d895fff51ce45e - a2645076ed071ab0bc6998183170037e46fc8ab8e208cfe38c3ac4b9de49119a -
a2645076ed071ab0bc6998183170037e46fc8ab8e208cfe38c3ac4b9de49119a - c3e8046bc4fc0fcb2cb4d76b22502a300eb5bd9a6eb6f1208e0e5643bb93ef3c -
c3e8046bc4fc0fcb2cb4d76b22502a300eb5bd9a6eb6f1208e0e5643bb93ef3c
Embedded URLs
- http://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- https://www.digicert.com/CPS0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- www.digicert.com
- crl3.digicert.com
- crl4.digicert.com
- cacerts.digicert.com
Embedded IP addresses
- 2.0.94.80
- 40.79.167.9
- 20.247.184.197
- 4.230.171.124
- 185.92.73.84
- 52.110.12.31
- 52.110.12.42
- 40.84.85.40
- 20.184.175.14
- 4.150.223.102
- 72.154.7.103
- 52.148.114.188
- 52.110.12.8
- 52.110.12.30
More RedLine samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report