MALICIOUS — 7782afde156fd317c93d9e1a093a024e29df63b8192b6e637bde4e3954912fc6
MALICIOUS — 7782afde156fd317c93d9e1a093a024e29df63b8192b6e637bde4e3954912fc6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 7 of 56 detection engines flagged it.
Identification
- SHA-256:
7782afde156fd317c93d9e1a093a024e29df63b8192b6e637bde4e3954912fc6 - SHA-1:
5430d0540a44a3c8d608b4a3ffe12fd8718343ba - MD5:
3471573087d7d189c8c8bee740fafd4d - imphash:
e48cc266501c282987b27f2c1f654e2d - ssdeep:
98304:3M68QptzN0ufWPIjEMt+w4HMadeL+f5IswiIt2l:3MNUn0ufOwEtw4bdeyBz3It2l - TLSH:
T1886233533B688F26C32C825B1043060D46DFB8A55EC14A57CC269B639CFA29B577FB09 - Submitted as: 7782afde156fd317c93d9e1a093a024e29df63b8192b6e637bde4e3954912fc6
- File type: pe · Size: 4397056 bytes
- Verdict: malicious (100/100) · Family: RedLine
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:,,,.tn6AMHn
- ClamAV (daily): Win.Trojan.Generic-9907417-0
- YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
- Detect It Easy (packer/type): DIE:ASProtect
- Microsoft Defender: Trojan:Win32/Reline.RA!MTB
- Emsisoft (Emergency Kit): Trojan.Agent
- Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.aidq
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Generic-9907417-0 (rule
Win.Trojan.Generic-9907417-0) - engine signal, weight 0.90, confidence 0.95 - Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in AppLaunch.exe (pid 6012) (rule
windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Reline.RA!MTB (rule
Trojan:Win32/Reline.RA!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent (rule
Trojan.Agent) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan-Spy.Win32.Stealer.aidq (rule
UDS:Trojan-Spy.Win32.Stealer.aidq) - engine signal, weight 0.55, confidence 0.85 - Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:ASProtect (rule
DIE:ASProtect) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:,,,.tn6AMHn (rule
high-entropy-sections:,,,.tn6AMHn) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule
YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70 - Packing/obfuscation: high-entropy-sections:,,,.tn6AMHn, ASProtect - static signal, weight 0.25, confidence 0.55
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
4836 behavior events · 0 ATT&CK techniques · 10 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- settings-win.data.microsoft.com
- watson.events.data.microsoft.com
- edge.microsoft.com
- ctldl.windowsupdate.com
Dropped files
- 27baa5a3204fa08292719d03ba86a24617407022fc1194b017dfb571efbd23ab -
27baa5a3204fa08292719d03ba86a24617407022fc1194b017dfb571efbd23ab - d4592d9714c3a919438da6358d82d4bfbb722c002f2bfdbb05c1ec1c14cfcbd7 -
d4592d9714c3a919438da6358d82d4bfbb722c002f2bfdbb05c1ec1c14cfcbd7 - c618e8e2eb64759d2fbe3868fbd45c6d62f6ec4e01bb34feef588e585dce8abc -
c618e8e2eb64759d2fbe3868fbd45c6d62f6ec4e01bb34feef588e585dce8abc - c3ec8c4ec0b4bc6a432608ebc9bc9b35a5e31f4574a8f88ad4859a25dbefb1ee -
c3ec8c4ec0b4bc6a432608ebc9bc9b35a5e31f4574a8f88ad4859a25dbefb1ee - bbb190e5fc0859d1001507ea96ca337bef896090698808aede31e6debe85de6d -
bbb190e5fc0859d1001507ea96ca337bef896090698808aede31e6debe85de6d - 0b5265e0ec0fd5c338e02bdfb8a98460ec8dcbec6da11dfff441fd2824c6193c -
0b5265e0ec0fd5c338e02bdfb8a98460ec8dcbec6da11dfff441fd2824c6193c - f390388fec1016a90efa0bbb1de0aa4bc3fc80446c629e4a8ee6fdc921b0ea09 -
f390388fec1016a90efa0bbb1de0aa4bc3fc80446c629e4a8ee6fdc921b0ea09 - a7e908e0f1a7f790e51598d8e43dd5b76a48bb8d98d19b225ba9fef071246243 -
a7e908e0f1a7f790e51598d8e43dd5b76a48bb8d98d19b225ba9fef071246243 - 755adcd14f99be98bea7a981181d54f3fd711066fc392fcd636c2d76992182a0 -
755adcd14f99be98bea7a981181d54f3fd711066fc392fcd636c2d76992182a0 - 07dd3ae8882304a3e0d12d7e63b64727ccc0bcbeadd6bcc1f2850e1f94e96f40 -
07dd3ae8882304a3e0d12d7e63b64727ccc0bcbeadd6bcc1f2850e1f94e96f40
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- a.ml
- 9y.hk
Embedded IP addresses
- 52.110.12.44
- 20.184.175.4
- 52.230.59.222
- 4.230.171.124
- 20.42.179.192
- 193.38.54.84
- 135.233.45.221
- 57.154.63.210
- 72.145.35.110
- 52.148.114.188
- 52.110.12.54
File paths
- i:\=[Q
More RedLine samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report