MALICIOUS — 14b2c50bbcba74e4ce2c47df644ec0e1d919a2f1fdcff389030c5b1c89f3131b

MALICIOUS — 14b2c50bbcba74e4ce2c47df644ec0e1d919a2f1fdcff389030c5b1c89f3131b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 14b2c50bbcba74e4ce2c47df644ec0e1d919a2f1fdcff389030c5b1c89f3131b
SHA-1: 99c59c106c4c2b324ff55b28c401dcd7b34249c1
MD5: 91204f8e63ed4d9cbb5651d1460b3543
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 3072:sWbgR2XKOsbRsxyUhF7b9x+ZgXRds85bs4gcYFQft2X3xXDGma1p5N9fGOun3fzR:sWbm5bRi6gXRdLNYQ23xiLGsny
TLSH: T13D48FA9693DC1ED0DC9C402A067E1E5B45CF946EB8F2370E0AE898F14F7863F59211A6
Submitted as: 14b2c50bbcba74e4ce2c47df644ec0e1d919a2f1fdcff389030c5b1c89f3131b
File type: pe · Size: 360856 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (4 of 56 engines)

LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: flagged
Trellix Stinger (McAfee): AgentTesla-FDDZ!91204F8E63ED
Kaspersky (KVRT): UDS:Trojan-Spy.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDDZ!91204F8E63ED (rule AgentTesla-FDDZ!91204F8E63ED) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.MSIL.Stealer.gen (rule UDS:Trojan-Spy.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5822 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

19e13096f2c35361ab243c13633445a62709945febd657595ef781172c1a4ef2 - 19e13096f2c35361ab243c13633445a62709945febd657595ef781172c1a4ef2

Embedded URLs

http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com

Embedded IP addresses

20.42.65.88
4.230.171.124
57.155.104.224
4.144.132.114
74.178.76.54
135.233.95.144
172.64.154.167
20.50.201.205
74.178.240.61
164.132.202.23
92.223.78.30
52.110.12.32
52.110.12.8
135.233.45.222
104.46.162.230
40.84.85.40
72.154.7.113
52.148.114.188
52.110.12.22
52.110.12.30

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report