MALICIOUS — 70afc8a4da79e47f9ae96543ca4accfc975ce81d4244e9665e36e12ba2382ffa

MALICIOUS — 70afc8a4da79e47f9ae96543ca4accfc975ce81d4244e9665e36e12ba2382ffa is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 70afc8a4da79e47f9ae96543ca4accfc975ce81d4244e9665e36e12ba2382ffa
SHA-1: 3ee3ad58fd4bd5dd059424d3a42da277c8041820
MD5: f20c36d92c304c69c045b26314ecab88
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:qqPwbBFhlZvkReZH5CIyaG15IyynPBVQze8LfyoODpZ161Dr1g9TU:qAwbF8s5PyaG15tKKsO
TLSH: T1E34F0CC58F4F0D01CE6919EBDB3D527E4686E68665F3BDC41A78D221A408FA336016B3
Submitted as: 70afc8a4da79e47f9ae96543ca4accfc975ce81d4244e9665e36e12ba2382ffa
File type: pe · Size: 743832 bytes
Verdict: malicious (100/100) · Family: RedLine

Detections (5 of 56 engines)

capa (capabilities): capability:execution/powershell
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:MSIL/AgentTesla.DLB!MTB
Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.200455
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.DLB!MTB (rule Trojan:MSIL/AgentTesla.DLB!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.MSILHeracles.200455 (rule Gen:Variant.MSILHeracles.200455) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5565 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

38ec85f55616924ff3f01f238061d2dbdacfab91a5b9be1aa63b0c4e79f64519 - 38ec85f55616924ff3f01f238061d2dbdacfab91a5b9be1aa63b0c4e79f64519

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.8
52.230.59.222
52.123.252.202
4.230.171.124
172.64.154.167
185.215.113.57
135.234.160.244
48.211.4.16
40.84.85.40
20.184.175.13
13.69.116.108
92.223.78.30
72.154.7.111
52.148.114.188
52.110.12.37
52.110.12.55

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report