MALICIOUS — cab1328a5b57e9e45bcdf6f4fbf19e8aa7b348297686618c7ab90e765be23876

MALICIOUS — cab1328a5b57e9e45bcdf6f4fbf19e8aa7b348297686618c7ab90e765be23876 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 7 of 56 detection engines flagged it.

Identification

• SHA-256: cab1328a5b57e9e45bcdf6f4fbf19e8aa7b348297686618c7ab90e765be23876
• SHA-1: ca4797b5f26d494c498d39dc0da365607d4f202f
• MD5: 01a2593387867c27627f415be37e029a
• imphash: e48cc266501c282987b27f2c1f654e2d
• ssdeep: 98304:qThkmwH8gwnl0SMFuZdOvdfU+/UL9oIOcjKl+CY:MiH8gwqhvds+Y9rOuTb
• TLSH: T12562338933F64A9DE97C546E20045EBEB70B5AA9710EA7D13C487A07F49C89B2B0074D
• Submitted as: cab1328a5b57e9e45bcdf6f4fbf19e8aa7b348297686618c7ab90e765be23876
• File type: pe · Size: 4414976 bytes
• Verdict: malicious (100/100) · Family: RedLine

Detections (7 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:,,,,.tct6cJ0
• ClamAV (daily): Win.Trojan.Generic-9907417-0
• YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
• Detect It Easy (packer/type): DIE:ASProtect
• Microsoft Defender: Trojan:Win32/Reline.RA!MTB
• Emsisoft (Emergency Kit): Trojan.Agent
• Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.agvh

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Generic-9907417-0 (rule Win.Trojan.Generic-9907417-0) - engine signal, weight 0.90, confidence 0.95
• Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
• Microsoft Defender flagged Trojan:Win32/Reline.RA!MTB (rule Trojan:Win32/Reline.RA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan-Spy.Win32.Stealer.agvh (rule UDS:Trojan-Spy.Win32.Stealer.agvh) - engine signal, weight 0.55, confidence 0.85
• Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:ASProtect (rule DIE:ASProtect) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:,,,,.tct6cJ0 (rule high-entropy-sections:,,,,.tct6cJ0) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
• Packing/obfuscation: high-entropy-sections:,,,,.tct6cJ0, ASProtect - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

4541 behavior events · 0 ATT&CK techniques · 10 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• tatreriash.xyz
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• officeclient.microsoft.com
• windows.msn.com
• odc.officeapps.live.com
• www.msn.com
• settings-win.data.microsoft.com

Dropped files

• 31d0fb1d6a2059484ee8c231b198fc060115b6f63c0956e0ef579ce8fe50173f - 31d0fb1d6a2059484ee8c231b198fc060115b6f63c0956e0ef579ce8fe50173f
• b586c9a094d592764e4b860c7d85e58c3ac9b8efb995617723bbb4c1d5c2f1d0 - b586c9a094d592764e4b860c7d85e58c3ac9b8efb995617723bbb4c1d5c2f1d0
• 07ea3df33ac4d236990bd8b67c97f6424da7175bc7198544decf777f8c3e11e7 - 07ea3df33ac4d236990bd8b67c97f6424da7175bc7198544decf777f8c3e11e7
• c334bd3127edd3a3ce27735aa51f092b7aa7f851141044757d617f99f33bc3cd - c334bd3127edd3a3ce27735aa51f092b7aa7f851141044757d617f99f33bc3cd
• 71d221cbe510780ad88d7b4b66dac1b4f412eff1fe5c7f4ea569f0321983bdf2 - 71d221cbe510780ad88d7b4b66dac1b4f412eff1fe5c7f4ea569f0321983bdf2
• 462acc8399c15e0642f2ff0a6e1bbbfcd09e826c6394c21f79020903186d4aea - 462acc8399c15e0642f2ff0a6e1bbbfcd09e826c6394c21f79020903186d4aea
• eebc1b62d48ef69541b02f077baa4d0444e80692f2bf44183cefb7d15b58f979 - eebc1b62d48ef69541b02f077baa4d0444e80692f2bf44183cefb7d15b58f979
• 380054ffbf17414362bd9edbfc8470ab3c45984bc418274ba50a55f4e56043fa - 380054ffbf17414362bd9edbfc8470ab3c45984bc418274ba50a55f4e56043fa
• 01129b16f94b407ccdb5534e735ee50e16a18e156fd64bdb499c3aa7f15f7fd4 - 01129b16f94b407ccdb5534e735ee50e16a18e156fd64bdb499c3aa7f15f7fd4
• 0b688fbfb967a7fa21be94c660f8fbaee134a854b547b74de2399dac53a5bd3f - 0b688fbfb967a7fa21be94c660f8fbaee134a854b547b74de2399dac53a5bd3f

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl

Embedded domains

• 27.to
• 9.sh
• c.ua
• tatreriash.xyz
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 4.150.223.97
• 4.230.171.124
• 20.247.184.197
• 20.42.179.192
• 74.178.240.51
• 20.184.175.5
• 135.232.92.137
• 52.123.252.220
• 52.110.12.11
• 52.110.12.16
• 172.64.154.167
• 135.234.160.245
• 72.153.5.61
• 52.110.12.52
• 52.148.114.188
• 52.110.12.32

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report