MALICIOUS — 8eebf759f00c6e2f5967482ef9eded2eed37ca6797ac4edf130ec7e2ceef4cae

MALICIOUS — 8eebf759f00c6e2f5967482ef9eded2eed37ca6797ac4edf130ec7e2ceef4cae is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8eebf759f00c6e2f5967482ef9eded2eed37ca6797ac4edf130ec7e2ceef4cae
SHA-1: 85b2d10284b8e735018ab3613a2fc132c656b98f
MD5: 3d6f09c0bd0ac74cc8e28e147ef1626b
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:RxGlwNykKzbtShlWAHWi5sYr0JZEQB3n5zgbcz6nY29S:Rx8AMpShlFHWi5sYr0JZEpbcz6nx9S
TLSH: T14447EE87C39C5E23D4FC401E0A7E6C9B47EBD4AC5471322A62282E259E7453F19633B6
Submitted as: 8eebf759f00c6e2f5967482ef9eded2eed37ca6797ac4edf130ec7e2ceef4cae
File type: pe · Size: 341912 bytes
Verdict: malicious (100/100) · Family: RedLine

Detections (5 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:MSIL/AgentTesla.LJB!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDDZ!3D6F09C0BD0A
Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Reline

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.LJB!MTB (rule Trojan:MSIL/AgentTesla.LJB!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!3D6F09C0BD0A (rule AgentTesla-FDDZ!3D6F09C0BD0A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-PSW.MSIL.Reline (rule UDS:Trojan-PSW.MSIL.Reline) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 3.4.50.67 - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9232 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

d5e44589caeaf2f32bd746704366636fadb3c4a99d60af664a5bff077e014220 - d5e44589caeaf2f32bd746704366636fadb3c4a99d60af664a5bff077e014220

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

3.4.50.67
20.247.184.142
4.150.223.102
4.230.171.124
104.18.33.89
185.215.113.205
52.110.12.37
52.110.12.56
172.178.240.161
135.233.45.222
172.215.188.225
172.178.240.163
20.184.175.13
20.184.175.0
52.148.114.188
72.145.35.106
52.110.12.4
52.110.12.22

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report