MALICIOUS — 7f8f6e66c5078bec99ee67990130fab1980012384f01e89fdde2233951218624

MALICIOUS — 7f8f6e66c5078bec99ee67990130fab1980012384f01e89fdde2233951218624 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the RedLine family. 9 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7f8f6e66c5078bec99ee67990130fab1980012384f01e89fdde2233951218624
SHA-1: ed290ef51cafc2520107205d97fa28d4186a53f4
MD5: 58e4858f0e6a8f1dacf827c130d967a4
imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
File type: pe · Size: 2476469 bytes
Verdict: malicious (99/100) · Family: RedLine

Detections (9 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Agent-6943819-1
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.91
Kaspersky (KVRT): Virus.Win32.Agent.es
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Trellix Stinger (McAfee): PolyPatch-UPX

MITRE ATT&CK

Dynamic analysis (windows)

20590 behavior events · 1 ATT&CK techniques · 97 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/12320/files/e9f5e9bb0b18f1af9b0c655c98ebc6d06218f1e1fd359edc96f33d250a9ecc18 — e9f5e9bb0b18f1af9b0c655c98ebc6d06218f1e1fd359edc96f33d250a9ecc18
/opt/CAPEv2/storage/analyses/12320/files/3f8739ff0141607879723cbc9a792cddc82ce24e9a76e98c403ed4734be49e04 — 3f8739ff0141607879723cbc9a792cddc82ce24e9a76e98c403ed4734be49e04
/opt/CAPEv2/storage/analyses/12320/files/4e9fdf5c70ef6144c9edd03374e4bdfa4f80971c0940120cdf75e7d57f2c7b64 — 4e9fdf5c70ef6144c9edd03374e4bdfa4f80971c0940120cdf75e7d57f2c7b64
/opt/CAPEv2/storage/analyses/12320/files/111ae450d0b606a981bac29079ba73e966f284c2353103bc5d0bdae642a6f15c — 111ae450d0b606a981bac29079ba73e966f284c2353103bc5d0bdae642a6f15c
/opt/CAPEv2/storage/analyses/12320/files/ca40d9fc1ed910b89c2d5158d9712094c5029930981c1a19b25a9e4e68eb8d10 — ca40d9fc1ed910b89c2d5158d9712094c5029930981c1a19b25a9e4e68eb8d10
/opt/CAPEv2/storage/analyses/12320/files/30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76 — 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
/opt/CAPEv2/storage/analyses/12320/files/d4262a842723e751e7ed5da24a90ea922dc0ab84d4d7e2b2d1de22ae30d62ea7 — d4262a842723e751e7ed5da24a90ea922dc0ab84d4d7e2b2d1de22ae30d62ea7
/opt/CAPEv2/storage/analyses/12320/files/860fdcafdaa6346f10214950f68994da715478f2ad4699d768d5a0cadaf43a9f — 860fdcafdaa6346f10214950f68994da715478f2ad4699d768d5a0cadaf43a9f
/opt/CAPEv2/storage/analyses/12320/files/9a5d83ddc4f0b7d8926223b143da17e45e5a556cf23184fd2cde6200cb7f2533 — 9a5d83ddc4f0b7d8926223b143da17e45e5a556cf23184fd2cde6200cb7f2533
/opt/CAPEv2/storage/analyses/12320/files/db7676a30a1394d3bcdbda8f84885c8a923cae30cb93f9ff43237a2dfe4e8be5 — db7676a30a1394d3bcdbda8f84885c8a923cae30cb93f9ff43237a2dfe4e8be5
/opt/CAPEv2/storage/analyses/12320/files/b33e97cdba2686b5f345356209ea9459b3ef61bff44c8108a278f865f484fe51 — b33e97cdba2686b5f345356209ea9459b3ef61bff44c8108a278f865f484fe51
/opt/CAPEv2/storage/analyses/12320/files/558319bfb1e09896e6dbb8e98ec03f83fafa9669e81d9acd298ff9eec4e644c2 — 558319bfb1e09896e6dbb8e98ec03f83fafa9669e81d9acd298ff9eec4e644c2
/opt/CAPEv2/storage/analyses/12320/files/734a1d86bbbf213de237ed5eac9dafb8884a18bd2d8824da66f7e134a400578e — 734a1d86bbbf213de237ed5eac9dafb8884a18bd2d8824da66f7e134a400578e
/opt/CAPEv2/storage/analyses/12320/files/e6746f87a75a96924b115db70419ef5de6555361b330ed222a3eeb4a7c34cf8e — e6746f87a75a96924b115db70419ef5de6555361b330ed222a3eeb4a7c34cf8e
/opt/CAPEv2/storage/analyses/12320/files/2e6ff1780ddb59b1c8104520466644e576cb0bbd68f7fc838d875b22bbe6fd5d — 2e6ff1780ddb59b1c8104520466644e576cb0bbd68f7fc838d875b22bbe6fd5d

Embedded URLs

http://creativecommons.org/publicdomain/zero/1.0/
http://www.adobe.com/go/reader_system_reqs_it.UnmoveFilesRimozione
http://www.adobe.com/go/reader_system_reqs_it
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.w3.org/TR/css3-text/
http://www.w3.org/2003/g/data-view#
http://www.w3.org/1999/xhtml
http://www.w3.org/2001/XMLSchema-instance
http://www.w3.org/2001/XMLSchema
http://www.w3.org/2002/xforms
http://www.w3.org/2001/xml-events
http://www.w3.org/1998/Math/MathML
http://openoffice.org/2004/office
http://openoffice.org/2004/writer
http://www.w3.org/1999/xlink

Embedded domains

creativecommons.org
geocities.com
www.adobe.com
helpx.adobe.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
www.w3.org
openoffice.org
purl.org
gmail.com
wiki.documentfoundation.org

Embedded IP addresses

26.2.4.2
52.110.12.37
52.110.12.26
52.168.117.171
20.42.179.204
4.144.132.114
4.230.171.124
74.179.77.204
135.232.92.97
20.42.65.84
135.232.92.137
13.89.179.15
172.178.240.163
203.26.79.13
52.123.252.235
135.232.92.34
135.234.160.245
52.148.114.188
20.165.94.46
52.110.12.15
72.154.7.111
52.110.12.32

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report