MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b
SHA3-384 hash: 1753c4ecbb0ddaa8b9a2385d1d8b519c995693f9813b751938c319c7944f35b6a6560f278a3b08f2584a1a9a7b132e90
SHA1 hash: 88e861d5f6b5f5d147cebd69994b74b895772576
MD5 hash: df14255c500bbf2fd0b9740021fde603
humanhash: red-asparagus-failed-minnesota
File name:SecuriteInfo.com.Trojan.GenericKD.39240318.16442.9435
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:10'240 bytes
First seen:2022-03-21 18:17:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 192:vgWZMfn4E1lTDO82B5J94Qu6Q2beJcnI:vnVUTaFB5J94yHccn
Threatray 7 similar samples on MalwareBazaar
TLSH T1AE22E511FBF849B9E97F8F356C72526417B1FB524A26D96E6888500B0E337404AA3F32
Reporter SecuriteInfoCom
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
df14255c500bbf2fd0b9740021fde603.exe.vir
Verdict:
Malicious activity
Analysis date:
2022-03-22 02:10:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6016a95d-d7f0-4fe5-a398-6a7407760c2a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/253771/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.39240318.16442.9435.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6238c172dfdfa8501cc82a2d/reports/8835d2aa-106c-42d4-9a94-662bbba8b4fa/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c4633989-5922-4677-ba12-8785ed8b54f0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/961072
Signature
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 15:23:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
140831c456eb79b85764ffe241d69f5c01b83af5ca6f124a8f9ef9399e0b648c
RedLineStealer
2e3690d2a5638c8d077996c40c62d20e715f230c549f3c0444f9055178d0a3e3
RedLineStealer
4720f1157f89c7fd2e13f9d51533641bff6ef02746e038231ca56b7f96f3826a
RedLineStealer
77178a444840db24cd1398ba699419627ae1ab61bdecda746abd3dd415bccd44
RedLineStealer
7e256fce202d614f9db74f19f635420b9a7d5b24962b8d9a669c52c93b9a8a67
RedLineStealer
adee061b8f1a879027c5fdb183aba13d2893764ee92178a7e14ce57018ea1cc9
RedLineStealer
e8cd3d10b40496dadd04dd9f7c0d916b8ac45a1366ce537ad0128f5f7e47847b
RedLineStealer
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/220321-wxlsgsddg5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b
MD5 hash:
df14255c500bbf2fd0b9740021fde603
SHA1 hash:
88e861d5f6b5f5d147cebd69994b74b895772576
Link:
https://www.unpac.me/results/7b6a54de-0357-49b4-8d14-27bbaf917a56/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2109387/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/253771/

Comments