MALICIOUS — b1395c031dde2994c40bba91476bcce0357ea357772d9084d1412a606b51505d
MALICIOUS — b1395c031dde2994c40bba91476bcce0357ea357772d9084d1412a606b51505d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
b1395c031dde2994c40bba91476bcce0357ea357772d9084d1412a606b51505d - SHA-1:
8d3d5eae3a8d56f1222ff2716b22b5c843b09217 - MD5:
800eacbae776de28d337daf4b41df602 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
3072:ZDX7D4wX40e4G9K/R6thJ7TAXx7v3NZI9vUO:l4U40e4G9K4vC - TLSH:
T1C93B2ACC1A64131DCA799F22704091ED24A5BCA7E5BA6F0C0904893614BCE3F6F7E65E - Submitted as: b1395c031dde2994c40bba91476bcce0357ea357772d9084d1412a606b51505d
- File type: pe · Size: 106744 bytes
- Verdict: malicious (100/100) · Family: RedLine
Detections (6 of 56 engines)
- capa (capabilities): capability:credential-access
- ClamAV (daily): Win.Dropper.Lazy-9916235-0
- Microsoft Defender: PWS:MSIL/RedLine.GG!MTB
- Emsisoft (Emergency Kit): Trojan-Spy.Agent
- Trellix Stinger (McAfee): PWS-FDHJ!800EACBAE776
- Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Lazy-9916235-0 (rule
Win.Dropper.Lazy-9916235-0) - engine signal, weight 0.90, confidence 0.95 - Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged PWS:MSIL/RedLine.GG!MTB (rule
PWS:MSIL/RedLine.GG!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan-Spy.Agent (rule
Trojan-Spy.Agent) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-FDHJ!800EACBAE776 (rule
PWS-FDHJ!800EACBAE776) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule
HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85 - access stored credentials (rule
access stored credentials) - capa signal, weight 0.50, confidence 0.80 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 3 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- capa (capabilities) flagged capability:credential-access (rule
capability:credential-access) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis (windows)
576 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- ec015b9184ab1a2d1acfea7ed4dc5fc016d9a68719a488fa87afe6f3d77c9af7 -
ec015b9184ab1a2d1acfea7ed4dc5fc016d9a68719a488fa87afe6f3d77c9af7
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 20.184.175.0
- 4.230.171.124
- 40.84.85.40
- 20.247.185.124
- 20.42.179.204
- 74.178.240.51
- 20.42.73.25
- 20.165.94.63
- 194.15.46.144
- 92.223.78.30
- 52.110.12.3
- 52.110.12.8
- 52.148.114.188
- 72.154.7.97
- 52.110.12.16
- 52.110.12.45
More RedLine samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report