MALICIOUS — c7369a3d1f5d2244bb1a32e5f5d4d707939ca6dcfc4065c4af1abd97ae293e69
MALICIOUS — c7369a3d1f5d2244bb1a32e5f5d4d707939ca6dcfc4065c4af1abd97ae293e69 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 7 of 56 detection engines flagged it.
Identification
- SHA-256:
c7369a3d1f5d2244bb1a32e5f5d4d707939ca6dcfc4065c4af1abd97ae293e69 - SHA-1:
92ceb045aa2440d43c2893e341de27be8beb14b1 - MD5:
f478891eaed23dc08353fb6d9bfaf0cd - imphash:
e48cc266501c282987b27f2c1f654e2d - ssdeep:
98304:sVe3OzO3xK8YGWZaNhlNIoaF1x9aZ1CLShT8m/k:ye3txK8YGyaNhPINv9ShfM - TLSH:
T13C6233F4B263B659EA5FE318DC50F21D0B99A4F81A531A7D4950661802EC307BB3F4B2 - Submitted as: c7369a3d1f5d2244bb1a32e5f5d4d707939ca6dcfc4065c4af1abd97ae293e69
- File type: pe · Size: 4406784 bytes
- Verdict: malicious (100/100) · Family: RedLine
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:,,,.MFMj9rB
- ClamAV (daily): Win.Trojan.Generic-9907417-0
- YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
- Detect It Easy (packer/type): DIE:ASProtect
- Microsoft Defender: Trojan:Win32/Reline.RA!MTB
- Emsisoft (Emergency Kit): Trojan.Agent
- Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.aiet
Why this verdict
The malicious score of 100/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Generic-9907417-0 (rule
Win.Trojan.Generic-9907417-0) - engine signal, weight 0.90, confidence 0.95 - Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged Trojan:Win32/Reline.RA!MTB (rule
Trojan:Win32/Reline.RA!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent (rule
Trojan.Agent) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan-Spy.Win32.Stealer.aiet (rule
UDS:Trojan-Spy.Win32.Stealer.aiet) - engine signal, weight 0.55, confidence 0.85 - Contacted 3 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:ASProtect (rule
DIE:ASProtect) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:,,,.MFMj9rB (rule
high-entropy-sections:,,,.MFMj9rB) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule
YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70 - Packing/obfuscation: high-entropy-sections:,,,.MFMj9rB, ASProtect - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
4892 behavior events · 0 ATT&CK techniques · 10 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- watson.events.data.microsoft.com
- edge.microsoft.com
- ctldl.windowsupdate.com
- time.windows.com
Dropped files
- 9411f5fb92290c6fdade30410428e46f313c0f073c2a8ecbd7962f29222b0269 -
9411f5fb92290c6fdade30410428e46f313c0f073c2a8ecbd7962f29222b0269 - 09625bca091d6fee589517b1235b94df23f46c7e0d79ffef2789692d1062cb74 -
09625bca091d6fee589517b1235b94df23f46c7e0d79ffef2789692d1062cb74 - 7dd2b0854dda79dbaba8d143c705ed9c0a42baf99b92b97e28ba9620e493b35f -
7dd2b0854dda79dbaba8d143c705ed9c0a42baf99b92b97e28ba9620e493b35f - 42a4866ca6ff68b930d9a7952568d229236b6fec0df558f87c600eb475cf8a05 -
42a4866ca6ff68b930d9a7952568d229236b6fec0df558f87c600eb475cf8a05 - 9cab2d4837f5484c3c3b1341d1744093d553d0a0b6ae612863379d7d68a0ed0b -
9cab2d4837f5484c3c3b1341d1744093d553d0a0b6ae612863379d7d68a0ed0b - 8521e75bc4c66ec545a69d1e69bb6e6e2b2bef69b890d3526bfd64aeeeb62075 -
8521e75bc4c66ec545a69d1e69bb6e6e2b2bef69b890d3526bfd64aeeeb62075 - da30d9b935be95a1bb9a47ee7b09be2a9563f573ba8a42f20378663116f762a3 -
da30d9b935be95a1bb9a47ee7b09be2a9563f573ba8a42f20378663116f762a3 - 8ce9522af98e4922fd291266f0b8ec17ef2977b9f5f15f0b56bb838d6f6fbbac -
8ce9522af98e4922fd291266f0b8ec17ef2977b9f5f15f0b56bb838d6f6fbbac - 4b7a888f19df461f1d90a79c21ff125b8cf5aedd68ee9c1e459d45e4ebb4ee9f -
4b7a888f19df461f1d90a79c21ff125b8cf5aedd68ee9c1e459d45e4ebb4ee9f - b60facee7efcda6b6147555255b83b5844d41a4aa5a66e816763d84aa59e9b43 -
b60facee7efcda6b6147555255b83b5844d41a4aa5a66e816763d84aa59e9b43
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- 1.jp
- f.de
Embedded IP addresses
- 20.42.73.25
- 20.247.185.124
- 4.230.171.124
- 185.223.92.157
- 135.234.160.245
- 52.110.12.44
- 52.110.12.53
- 4.247.188.224
- 52.148.114.188
- 72.153.5.129
- 52.110.12.33
- 52.110.12.16
File paths
- f:\%7
- c:\0V
- y:\d=
More RedLine samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report