MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0a5faef2bdcce3d5b58e9062bf8f936596a96eaf0b270ed86cac3033cd922537. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 11
| SHA256 hash: | 0a5faef2bdcce3d5b58e9062bf8f936596a96eaf0b270ed86cac3033cd922537 |
|---|---|
| SHA3-384 hash: | 6562873f65bf8f31cefb2af76e641261358f2ff2382bf117794a3f50389d26c7ece231f35f24221c9825edaf1fd87f5f |
| SHA1 hash: | 67233ab2394ad1e75362cbc3278081ea5105d821 |
| MD5 hash: | 383b866c7b2a1039fbf537381399fed3 |
| humanhash: | foxtrot-avocado-alpha-missouri |
| File name: | 383b866c7b2a1039fbf537381399fed3.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 357'376 bytes |
| First seen: | 2021-01-08 18:35:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 83d64fbebfab92d1c7af4b69e750554f (1 x RedLineStealer, 1 x Amadey) |
| ssdeep | 6144:L2/aISRRSF+z6IiITXx/WUGbYFXt1fCMvJZfRRTMCFhLDuXlxX2i:LwSR9ziIE5bYF91DJpRpPS |
| Threatray | 928 similar samples on MalwareBazaar |
| TLSH | 5B741206E37054F8FC703DB0DB597BA142073A204BFFDD2BE9824D9979365D86AA1C98 |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
305
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
383b866c7b2a1039fbf537381399fed3.exe
Verdict:
Malicious activity
Analysis date:
2021-01-08 18:43:10 UTC
Tags:
rat redline trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Stealing user critical data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Ficker Stealer RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected Ficker Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Glupteba
Status:
Malicious
First seen:
2021-01-08 17:33:00 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 918 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:agenttesla family:redline discovery infostealer keylogger spyware stealer trojan upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
RedLine
Unpacked files
SH256 hash:
0a5faef2bdcce3d5b58e9062bf8f936596a96eaf0b270ed86cac3033cd922537
MD5 hash:
383b866c7b2a1039fbf537381399fed3
SHA1 hash:
67233ab2394ad1e75362cbc3278081ea5105d821
SH256 hash:
7480d376e3bff605e95a0cf235aa6c1c2a852650ac4023a3c37abc9019ee5cb5
MD5 hash:
a3df88428f15ed5232e1ffba19f8fbb4
SHA1 hash:
4d4f357f29a0dfa02d479547696cff666b01966a
SH256 hash:
3d1f8e72f7caebe74c79b66184b339d4b3e3f08eacace13784af91287c571601
MD5 hash:
006a15e719c50cdffada8b325c9bbea1
SHA1 hash:
3705416bc798bc4d42c527c29824e218d0dd9093
Detections:
win_redline_stealer_g0
SH256 hash:
718473e2be007352c59519b2fa71d3af63f159f2d3a63391d755e08bb435b3b5
MD5 hash:
30a1d313d50c3cb25e2e3908d8c201fe
SHA1 hash:
4a2db01c18c347c7090501c513f0804fd8bea6c7
Detections:
win_redline_stealer_g0
SH256 hash:
6ba584610a120e50651032a0bbdb4a5ac836d1c30e20d4b111f0790f4d75179f
MD5 hash:
69eeb5e008398dc2e59eda416a3ef949
SHA1 hash:
fda8d1de07cd08e10709498a482c06521381fb08
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekshen |
| Description: | Detects RedLine infostealer |
| Rule name: | suspicious_packer_section |
|---|---|
| Author: | @j0sm1 |
| Description: | The packer/protector section names/keywords |
| Reference: | http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.