MALICIOUS — b5e39acf564601595e6b6c24d666454264259f2ee3972bf3e96f75856e0310b4

MALICIOUS — b5e39acf564601595e6b6c24d666454264259f2ee3972bf3e96f75856e0310b4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Reline family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b5e39acf564601595e6b6c24d666454264259f2ee3972bf3e96f75856e0310b4
SHA-1: ca9ac933942e42d161e8c1ccd45e6fd099c64317
MD5: c6e8a3345f110d75515e4fb70a51a469
imphash: e48cc266501c282987b27f2c1f654e2d
ssdeep: 98304:naGEobRKjt+HXn5It5Gd4lnXGC6IN0G3H21lZReG:aGEoE+HXsGdi2CnN/XWReG
TLSH: T10F623305E8D6EA2ADD8FC42E4031C94D84ADD2B01CC5D34B9AA8225F9E7B84F352F1D5
Submitted as: b5e39acf564601595e6b6c24d666454264259f2ee3972bf3e96f75856e0310b4
File type: pe · Size: 4525568 bytes
Verdict: malicious (100/100) · Family: Reline

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:,,,.BPpGwbS
ClamAV (daily): Win.Trojan.Generic-9907417-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:ASProtect
Microsoft Defender: Trojan:Win32/Reline.RA!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.ahxv

MITRE ATT&CK

T1518.001

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907417-0 (rule Win.Trojan.Generic-9907417-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in AppLaunch.exe (pid 5412) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Reline.RA!MTB (rule Trojan:Win32/Reline.RA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-Spy.Win32.Stealer.ahxv (rule UDS:Trojan-Spy.Win32.Stealer.ahxv) - engine signal, weight 0.55, confidence 0.85
Contacted 5 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:ASProtect (rule DIE:ASProtect) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:,,,.BPpGwbS (rule high-entropy-sections:,,,.BPpGwbS) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Packing/obfuscation: high-entropy-sections:,,,.BPpGwbS, ASProtect - static signal, weight 0.25, confidence 0.55
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5237 behavior events · 0 ATT&CK techniques · 11 dropped files.

Dropped files

b4a322d05bc633971c25378dc1f4f6218263dc540eb4fe383073f28e48ed5726 - b4a322d05bc633971c25378dc1f4f6218263dc540eb4fe383073f28e48ed5726
30b942571372ff53b1eb557e6a4cc84023b4c1b2b8a22a276cf716df80136f0a - 30b942571372ff53b1eb557e6a4cc84023b4c1b2b8a22a276cf716df80136f0a
9ce472e306615fd6c5a97f7ea16dc07aa33c8aadccd211b41c876cb176921250 - 9ce472e306615fd6c5a97f7ea16dc07aa33c8aadccd211b41c876cb176921250
1cb94cf12d4a944ff649f97c4ae9d5b0d1a448857264e1a1b7de7a810ec4a0a6 - 1cb94cf12d4a944ff649f97c4ae9d5b0d1a448857264e1a1b7de7a810ec4a0a6
300a0a731b9a0b41cb4c4bbc4b1e986fa7f75517d5ecf5dafc8f9f4ec151610f - 300a0a731b9a0b41cb4c4bbc4b1e986fa7f75517d5ecf5dafc8f9f4ec151610f
5cab149e90623bf0a573db456db2f5f38ded2199573050d414985195e5602628 - 5cab149e90623bf0a573db456db2f5f38ded2199573050d414985195e5602628
278c3135fb1fb7955d3e81fb6d01d8f30e70792b56d810f56ed9ab910e775230 - 278c3135fb1fb7955d3e81fb6d01d8f30e70792b56d810f56ed9ab910e775230
95fbc622459a7d686e00afd186a01cba9678acdddc89a472c44c3873d9a3bf5e - 95fbc622459a7d686e00afd186a01cba9678acdddc89a472c44c3873d9a3bf5e
4fb12adbb5ac96839e3c56c68751fd836b24220c401c21de328109471933a52e - 4fb12adbb5ac96839e3c56c68751fd836b24220c401c21de328109471933a52e
b5ad554eb4889fcc1e9595b4791ca59bb401ee8ffe7dfb95815ad2138cd3105c - b5ad554eb4889fcc1e9595b4791ca59bb401ee8ffe7dfb95815ad2138cd3105c
36a242ee5b7e91df00550b661ce95491a34d9c51d7405ba2e93c58146889cffb - 36a242ee5b7e91df00550b661ce95491a34d9c51d7405ba2e93c58146889cffb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

kb.hk
29wa.fr
w.ca
r.me
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.21
4.230.171.124
135.232.92.97
48.211.4.16
135.232.92.137
20.42.65.94
20.247.185.124
13.69.116.107
52.110.12.54
52.110.12.37
4.209.250.170
20.42.65.93
34.104.35.123
52.123.252.242
203.26.79.13
135.234.160.246
62.182.156.188
104.18.33.89
52.148.114.188
72.153.5.63
52.110.12.18
52.110.12.32

More Reline samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report