MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06c523efc119e25eb28a59b9778ef4f7d738bc6bcd701c696568719ba6e6cee6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	06c523efc119e25eb28a59b9778ef4f7d738bc6bcd701c696568719ba6e6cee6
SHA3-384 hash:	4675b34037be2d2dfcf05ed2982805180b38833c053833b85a7d6f70c33db6f256426b8acb91a0b3ce39fb42675f7eec
SHA1 hash:	5002de39ebcaeb32456c2603308d1db2cade136d
MD5 hash:	35e90e13b63d3e6b10bb8b89e2165bb9
humanhash:	johnny-carpet-virginia-mobile
File name:	35e90e13b63d3e6b10bb8b89e2165bb9.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	20'480 bytes
First seen:	2021-02-11 08:04:00 UTC
Last seen:	2021-02-11 10:08:56 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	384:D4ti1/zveGQ1vN8FJUOmz0qDAb4lSLkeCAYF6b04/50IAGvZv:D4tiFvqz0qDAb4lSRw6Vh1
Threatray	4 similar samples on MalwareBazaar
TLSH	2692D862EBE0C33AE17E4BF059FA86428AF1B1454501EB5F4DC4515B9A13AC1CFB339A
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

107

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

35e90e13b63d3e6b10bb8b89e2165bb9.exe

Verdict:

Malicious activity

Analysis date:

2021-02-11 08:08:33 UTC

Tags:

trojan rat redline evasion

Link:

https://app.any.run/tasks/1815006b-c425-426f-85cd-7049d7ab9906

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/116698/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.7130.843.17900.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Launching a process

Sending a UDP request

Creating a file

Sending an HTTP POST request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file in the %temp% directory

Deleting a recently created file

Forced shutdown of a system process

Stealing user critical data

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/605469

Signature

Allocates memory in foreign processes

Binary contains a suspicious time stamp

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/06c523efc119e25eb28a59b9778ef4f7d738bc6bcd701c696568719ba6e6cee6/

Threat name:

ByteCode-MSIL.Trojan.Spider

Status:

Malicious

First seen:

2021-02-11 09:09:13 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a3csh36bdhrf5muklg4xpdxu67ltrpdlzvyby2lfnbyzxjxgz3ta._file

Verdict:

suspicious

RedLineStealer

887084bcfd243d9c685a80c8b94ff04b56936b6a282988a2488463ba70e7d054

RedLineStealer

ab726a7fa6bca9c0d71686c601534a575530461a42160f7c74e3eae694f64012

RedLineStealer

e8234089e3729bbb6cbf5cf5deddad37b3dbe90180bc307ac8105f5f240a5b82

RedLineStealer

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/210211-tybv3eh242/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

06c523efc119e25eb28a59b9778ef4f7d738bc6bcd701c696568719ba6e6cee6

MD5 hash:

35e90e13b63d3e6b10bb8b89e2165bb9

SHA1 hash:

5002de39ebcaeb32456c2603308d1db2cade136d

Link:

https://www.unpac.me/results/6ac8f283-3bb3-42b5-9d60-f814b5abc43a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/06c523efc119e25eb28a59b9778ef4f7d738bc6bcd701c696568719ba6e6cee6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time