MALICIOUS — bfea990816d006c6a6cf9be8c198e60a86b23dc8926e2cee5e62d207e001c6bc

MALICIOUS — bfea990816d006c6a6cf9be8c198e60a86b23dc8926e2cee5e62d207e001c6bc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the RedLine family. 3 of 56 detection engines flagged it.

Identification

• SHA-256: bfea990816d006c6a6cf9be8c198e60a86b23dc8926e2cee5e62d207e001c6bc
• SHA-1: e95181b6a3877f3793cf8ca0813e2e2cc4326577
• MD5: 81808423e45323cb5080ce171b005adf
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 6144:tGKxn3TEccOIXkaXXdQWhQCK2uviKoXXRWqA+YJy5jEXQYL7R+T:ISjfUUSXdQWhQCDu3bxJyQQOW
• TLSH: T10B4922D683BC1F51C8DC86AE0BBF0C8B46DB846965B1374E076C857E4B9873345329A2
• Submitted as: bfea990816d006c6a6cf9be8c198e60a86b23dc8926e2cee5e62d207e001c6bc
• File type: pe · Size: 390552 bytes
• Verdict: malicious (96/100) · Family: RedLine

Detections (3 of 56 engines)

• LIEF (executable format parser): lief:invalid-authenticode
• Emsisoft (Emergency Kit): Trojan.Crypt
• Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
• Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
• Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

1403 behavior events · 0 ATT&CK techniques · 17 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• officeclient.microsoft.com
• www.msn.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com

Dropped files

• 2a8c317d82d9d465236d9887f041a7d6b155065b39dd6b70b88ed282756cec0c - 2a8c317d82d9d465236d9887f041a7d6b155065b39dd6b70b88ed282756cec0c
• 7707a5d459e2480fd92d1734510c4b545cf7419452460cd3daceb45527cf30ac - 7707a5d459e2480fd92d1734510c4b545cf7419452460cd3daceb45527cf30ac
• aa692e461c7a441df4c4bb8791f90615176dc716e09171449b433c7f1396fa0f - aa692e461c7a441df4c4bb8791f90615176dc716e09171449b433c7f1396fa0f
• c9dcb6fe7a2ac2df9c1f07791f22b25faf8dd07d376fb771afb64d9464a6a1b0 - c9dcb6fe7a2ac2df9c1f07791f22b25faf8dd07d376fb771afb64d9464a6a1b0
• b6ea54b17e9acdf982b36c1aead8fc10266ef13e4ec8fb39ec213ea8d2db87c3 - b6ea54b17e9acdf982b36c1aead8fc10266ef13e4ec8fb39ec213ea8d2db87c3
• 9d99df1de5dc9763b9242a92059e1c1171692afe28edbb7c6ea6a9543f70dd7e - 9d99df1de5dc9763b9242a92059e1c1171692afe28edbb7c6ea6a9543f70dd7e
• d9b1bf087c4a800f2a881d5509d7d047422dcb5488b9146a5606d2eb3bf7952b - d9b1bf087c4a800f2a881d5509d7d047422dcb5488b9146a5606d2eb3bf7952b
• a7cdbd86f76459eb1bf539f0255994d66e00c461733d43422644473bd18ca3c6 - a7cdbd86f76459eb1bf539f0255994d66e00c461733d43422644473bd18ca3c6
• af1b8c6b579fcfbb12438b3216197d6575c499e5a2ba591d6be638b8ff13f5c2 - af1b8c6b579fcfbb12438b3216197d6575c499e5a2ba591d6be638b8ff13f5c2
• b6a3d7ec843988324c24eb439d4010628ae78a8c832c7d77d915ae1f69994c26 - b6a3d7ec843988324c24eb439d4010628ae78a8c832c7d77d915ae1f69994c26
• 7cfba7cbaea634f404cdd4eb471bfb4de619b75b98d3ccf280852505a867bfd2 - 7cfba7cbaea634f404cdd4eb471bfb4de619b75b98d3ccf280852505a867bfd2
• 96db617dc4991206ed63ee46f00154d964093e7b93b269d8bde53edbaef888bd - 96db617dc4991206ed63ee46f00154d964093e7b93b269d8bde53edbaef888bd
• c2a47f955a1677fb15b6a34c1777ee525c760b644898be9bf16e9878b8faec34 - c2a47f955a1677fb15b6a34c1777ee525c760b644898be9bf16e9878b8faec34
• b882e203aff70cd0705d6af344cc735ae9fa5be66faf024a7f558f132a564cf8 - b882e203aff70cd0705d6af344cc735ae9fa5be66faf024a7f558f132a564cf8
• b0009d80874451ad574863c7f427bf84a81c4ffa9779bb0114f9bf64e90b2194 - b0009d80874451ad574863c7f427bf84a81c4ffa9779bb0114f9bf64e90b2194

Embedded URLs

• http://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0
• https://www.digicert.com/CPS0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• www.digicert.com
• crl3.digicert.com
• crl4.digicert.com
• cacerts.digicert.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 51.105.71.137
• 52.123.252.222
• 4.230.171.124
• 4.247.188.233
• 20.247.185.124
• 74.178.240.61
• 20.165.94.54
• 20.42.65.94
• 104.18.33.89
• 20.184.175.12
• 185.215.113.109
• 52.110.12.14
• 52.110.12.4
• 125.56.205.42
• 125.56.205.32
• 4.150.223.100
• 51.116.246.105
• 72.154.7.114
• 52.148.114.188
• 92.223.78.30
• 52.110.12.46

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report