MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 032fa5601a6069aada31d048dd861f3e2a6c5630d34158e4675e4ad287d85416. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	032fa5601a6069aada31d048dd861f3e2a6c5630d34158e4675e4ad287d85416
SHA3-384 hash:	f6ed00943e0ee07f4f3741d76005750d6877b21531b4c173521db11361ceb37c7f8b81c0d5ad4c397c88a680555ebd23
SHA1 hash:	390ebf3d4300d068beee34af09f0ff171e643e78
MD5 hash:	8fb7946d29d68860b8bc07fcf90fae8d
humanhash:	friend-arkansas-autumn-romeo
File name:	8fb7946d29d68860b8bc07fcf90fae8d.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	483'450 bytes
First seen:	2022-01-03 15:53:41 UTC
Last seen:	2022-01-03 17:34:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep	12288:jbLp5P9aMyZU4bF9IOWaAtFi0vwNXNOVJG4vcRmX:jhXaXTl/0vwNXNOVJGgcQX
Threatray	5'749 similar samples on MalwareBazaar
TLSH	T11FA4231B7AC0A753EB89AB300952B33690FB4E7E103295D7C7882F6C72A5317520B6D7
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

306

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

8fb7946d29d68860b8bc07fcf90fae8d.exe

Verdict:

Malicious activity

Analysis date:

2022-01-03 15:55:42 UTC

Tags:

installer

Link:

https://app.any.run/tasks/787b2517-dbb8-416a-974c-b638fab93403

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/217181/

Detection(s):

SecuriteInfo.com.Trojan.NSISX.Spy.Gen.1.3121.29530.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Unauthorized injection to a recently created process

Creating a window

DNS request

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

60%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/61d31c1eaeeec3fd2dfa84e8/reports/0a2a027d-54a0-4ba7-9c53-87a38f877c2b/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e0a3f517-404e-42f0-bc79-b1d412ddc527

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/914940

Signature

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/032fa5601a6069aada31d048dd861f3e2a6c5630d34158e4675e4ad287d85416/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-01-03 14:05:45 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 28 (60.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=amx2kya2mbu2vwrr2ben3bq7hyvgyvrq2navrzdhlzfnfb6ykqla._file

Verdict:

malicious

Label(s):

agenttesla

RedLineStealer

7025a565fe7b2b8a05477201f7dfdf8f2735dd056626aa0fbf6a949a4e61179f

RedLineStealer

8426bc09e01e893337a5b15b947e6f176c1eb937768c70cd4c0526b0b710523a

RedLineStealer

9ebf3c694a87c9f93c27378fdda51cd32d56181b62d67186a8b95a744766c5d1

RedLineStealer

c9a81188add8b80467da4b6aca7e3dd8d4fa803be5f17d7df90a71c2bfc618f0

RedLineStealer

dd3f64e6a847fd8ba77ec995ef3c1b9b6ce164df8056545b9e537cf5a23f64a0

RedLineStealer

f80dd0bf7402bebd03d303c97c8dd3f921d3e923a2521f4a2af2e4bf3c288aa1

RedLineStealer

+ 5'739 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/220103-tb8c9abdh4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

032fa5601a6069aada31d048dd861f3e2a6c5630d34158e4675e4ad287d85416

MD5 hash:

8fb7946d29d68860b8bc07fcf90fae8d

SHA1 hash:

390ebf3d4300d068beee34af09f0ff171e643e78

Link:

https://www.unpac.me/results/e6499589-bc95-4cde-b181-4c418446b6b6/

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/032fa5601a60/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/032fa5601a6069aada31d048dd861f3e2a6c5630d34158e4675e4ad287d85416

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.