MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0fd29453e32c7b932aff741c9c2ea349e2105701ac56f1387678db16c634c85e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 10
| SHA256 hash: | 0fd29453e32c7b932aff741c9c2ea349e2105701ac56f1387678db16c634c85e |
|---|---|
| SHA3-384 hash: | 4056f1cef78bb25933bc8c0feeda6eee63b704cba3e2057a6269cdb83dff7c1797369fefee5ac3019c24905abb9a8879 |
| SHA1 hash: | 1d20fea7c303b2f55b27725894236b5fbab4ce0b |
| MD5 hash: | 02fc72aefd6ba0e3b1047c3c5d38e65a |
| humanhash: | eleven-uncle-nebraska-oregon |
| File name: | 02fc72aefd6ba0e3b1047c3c5d38e65a.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 1'033'216 bytes |
| First seen: | 2022-03-20 00:50:54 UTC |
| Last seen: | 2022-03-20 02:36:19 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:P/A0tbUwOULK8lYhQuLb/G0y+B2l3TiNKqCNXid6FvQCIKTXGk:P/LtbUfUL+A030ZiNChid6FvLII |
| Threatray | 244 similar samples on MalwareBazaar |
| TLSH | T145250213335A4E63C29E1673C1CF481197F2DFD5A523D64A3ED837AE0943363AA091AB |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 84.38.132.100:29934 | https://threatfox.abuse.ch/ioc/425028/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
323
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe obfuscated packed powershell redline replace.exe virus
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-03-17 15:15:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 27 (74.07%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 234 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Modifies data under HKEY_USERS
Unpacked files
SH256 hash:
4ffb59b76867dc3ee5df8b1476a82043c8bbfa9679aa90a2e4b937292b3722b8
MD5 hash:
fc6d91ff314356715f5c76ba61240c9f
SHA1 hash:
aac8291f9af1c2e18b8302550ee4d1c96120949a
SH256 hash:
49434b4925861233ca8d9f146dba203ec2f64fc7bc5f5483fee79bca529b5352
MD5 hash:
00be856a7db26ffab12640b802e9f4b0
SHA1 hash:
6b9dbf279d48aaab6e8d7534a02bd7b04994d4c6
SH256 hash:
a36d81d479d26ea8f33ef2ded9763fa48590b1509ee1737ffe3e7e9186c62c97
MD5 hash:
3e0f796e03c0ed66c4ab23d23d5e2b9b
SHA1 hash:
55d29cebbf85e60a3cdaf6113c1911500de51f3a
SH256 hash:
15f1f94887a90ce92612a8a8994a3a098071eabe8b9750b3dc12e5ce74a247d8
MD5 hash:
64a68197cef0613164efc1061fe07a4c
SHA1 hash:
3b416456499d9ef7024fb8906e5ab5a19b3fb3ff
SH256 hash:
0fd29453e32c7b932aff741c9c2ea349e2105701ac56f1387678db16c634c85e
MD5 hash:
02fc72aefd6ba0e3b1047c3c5d38e65a
SHA1 hash:
1d20fea7c303b2f55b27725894236b5fbab4ce0b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.