MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01b259c2a07e81f3a2636fcf80ddd3d90a7daaafc218eee30f9a8247f09e1f39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments 1

SHA256 hash:	01b259c2a07e81f3a2636fcf80ddd3d90a7daaafc218eee30f9a8247f09e1f39
SHA3-384 hash:	826a1b33c04996fd2c40458d33334dd9d687b1cd890f189c0a19248644f4eccdd9041a3bcccfafb5550fb8a4de81720c
SHA1 hash:	b46c0ecaa9168dee63292a3d2f5e01f2455e4a07
MD5 hash:	5514d7f00f8566e827efed4ca34f05db
humanhash:	mars-early-orange-blue
File name:	5514d7f00f8566e827efed4ca34f05db
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	119'016 bytes
First seen:	2021-09-01 18:25:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	1536:UteNE4bYKW1E5gfK1FSQFaAQAWdjbuRGdznLuyq/dJV4dbknErG6qTaoigyXX8:2epS6FSsMxvznCyOdJckEuiXX8
Threatray	1'560 similar samples on MalwareBazaar
TLSH	T120C34B7523DCCB28E7FE0E75B470010147F0E18B6502EB5B9DC6ACFA5E66B8267542E2
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

209

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5514d7f00f8566e827efed4ca34f05db

Verdict:

Malicious activity

Analysis date:

2021-09-01 18:29:06 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/f20f7ea9-60c5-4e1d-bd2f-9a859fe89918

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/184550/

Detection(s):

Win.Packed.Bulz-9883367-0

Win.Packed.Generickdz-9885340-0

Win.Packed.Bulz-9888336-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

DNS request

Sending a UDP request

Creating a window

Using the Windows Management Instrumentation requests

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Creating a file

Stealing user critical data

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7fa20763-2b4a-421c-9a39-3dc3994fb2f0

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/843591

Signature

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01b259c2a07e81f3a2636fcf80ddd3d90a7daaafc218eee30f9a8247f09e1f39/

Threat name:

ByteCode-MSIL.Infostealer.Reline

Status:

Malicious

First seen:

2021-09-01 18:26:09 UTC

AV detection:

19 of 27 (70.37%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=agzftqvap2a7hitdn7hybxot3efh3kvpyimo5yyptkbep4e6d44q._file

Verdict:

malicious

RedLineStealer

27c106e7c9e455f880849d79759df345d2117aa2e2357696dabb51bc11adce8b

RedLineStealer

39441b31111e865ef9d0aa72bee372afb6926cae4e2480fe246eee578a3dd51d

RedLineStealer

3ca3ef048fd26e03a002f3fc9d80ecf27621dd27643857cfdac7c60c26d36a27

RedLineStealer

6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9

RedLineStealer

808b5df757266da6326597fab78d005a83279f3ad1d04b103c196f66b67ad35b

RedLineStealer

d06f2c1e45f62b363834c1ed0bd33fcbcc3ba26b2c8075717b1ff124f273c4b5

RedLineStealer

f99b757416d428b28579a9a2554049908c88abf1a2f547fda30fe00e617f071f

RedLineStealer

+ 1'550 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:255

Link:

https://tria.ge/reports/210901-kw8e4d4mxx/

Malware Config

C2 Extraction:

45.14.49.28:5628

Unpacked files

SH256 hash:

01b259c2a07e81f3a2636fcf80ddd3d90a7daaafc218eee30f9a8247f09e1f39

MD5 hash:

5514d7f00f8566e827efed4ca34f05db

SHA1 hash:

b46c0ecaa9168dee63292a3d2f5e01f2455e4a07

Link:

https://www.unpac.me/results/b0fadb01-d75f-4588-bb81-cc8221223196/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/01b259c2a07e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/01b259c2a07e81f3a2636fcf80ddd3d90a7daaafc218eee30f9a8247f09e1f39

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	redline_stealer Create hunting rule
Author:	jeFF0Falltrades
Description:	This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)