MALICIOUS — 6c0e5e6620a3557e0d94570545123a91b6ae234142a1182e5fa75dbaada7650a

MALICIOUS — 6c0e5e6620a3557e0d94570545123a91b6ae234142a1182e5fa75dbaada7650a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6c0e5e6620a3557e0d94570545123a91b6ae234142a1182e5fa75dbaada7650a
SHA-1: 610574479a6e8fc986291cfdbbd442fee0e2d8a9
MD5: 9d0fa6571de1228b24261838bbe30610
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:fEO0uYOK+0T9sSFNDDVAVSdHyg51Ilu2mboUml4Vgv77/TNhQA6A:fz0BJ99ZDVV27Uml4Vgv77/TNhQA6A
TLSH: T12547EED7827C5C52C4BF442F1B7E6E7B49EBA4A99B72310E097844324A586370E631B3
Submitted as: 6c0e5e6620a3557e0d94570545123a91b6ae234142a1182e5fa75dbaada7650a
File type: pe · Size: 342424 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: flagged
Trellix Stinger (McAfee): AgentTesla-FDDZ!9D0FA6571DE1
Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!9D0FA6571DE1 (rule AgentTesla-FDDZ!9D0FA6571DE1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-PSW.MSIL.Stealer.gen (rule UDS:Trojan-PSW.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5820 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

1f579e8ffb349d8031dc69eb693d000ead5da8adb9f64e98ff5312a250452d12 - 1f579e8ffb349d8031dc69eb693d000ead5da8adb9f64e98ff5312a250452d12

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.100
4.230.171.124
4.144.132.223
85.210.193.152
20.165.94.63
20.165.94.54
135.232.92.137
4.207.44.76
185.215.113.57
20.42.179.204
172.178.240.163
72.153.5.61
52.148.114.188
52.110.12.4
52.110.12.55

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report