MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d03149eb8839cefbe072e5fed04a5a775f856b53ffa1373f235a6a5ddceb553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d03149eb8839cefbe072e5fed04a5a775f856b53ffa1373f235a6a5ddceb553
SHA3-384 hash: 7736c2c741f40d599231a69dcc5b5eaa72a3937e0facd6ca26197781cc287631dd397d1f8cdeae551bd5aa52032284dd
SHA1 hash: d9a19d08b817a88feaf08e00eee8a0479663a960
MD5 hash: e9ae8d2f81cc2981ae784f3648040a92
humanhash: tennis-cat-snake-delaware
File name:RFQ I Peikko proposal,pdf.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:737'280 bytes
First seen:2021-08-08 16:15:25 UTC
Last seen:2021-08-08 16:46:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:uQWRct2NjFmzP1Wy4ASG3smyH0/X6BDWaozKnaoEe0N:u7RcMNjgWy4ASG3K4KtvcRoE
TLSH T1AAF4BE10A3F9075AFAFBBB39A971015467F6F913A735C68E2E5500CC8971F80CAA1723
dhash icon 255a4b371b7b660f (11 x AgentTesla, 2 x AsyncRAT, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer Telegram

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ I Peikko proposal,pdf.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-08 16:16:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/25cb12de-dd13-42dd-9de9-d2ba5adef60b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177267/
Detection(s):
SecuriteInfo.com.HKTL_NET_NAME_Aggressor.12.13091.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
DNS request
Connection attempt
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a01fec1b-084b-4286-b6ce-b4c2c0e9d678
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/828830
Signature
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Crypto Currency Wallets
Uses the Telegram API (likely for C&C communication)
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d03149eb8839cefbe072e5fed04a5a775f856b53ffa1373f235a6a5ddceb553/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-08-08 16:16:10 UTC
AV detection:
9 of 27 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dubrjhvyqooo7pqhfzp62bffu527qvvvh75bg47sgwtklxoowvjq._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/210808-2qhmwg7y6s/
Behaviour
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Unpacked files
SH256 hash:
aed00f82f1772e5a403cce9c1349202c8371e67ed9ef19a33cac0bf2a411f3c1
MD5 hash:
c273f926e2a29bd62cc8f27b569a0b2a
SHA1 hash:
e08d302cab3e11d776599a6b0537207fce6f9c51
Link:
https://www.unpac.me/results/033b339f-a754-4e9d-8d96-eaaf8b3349f2/
SH256 hash:
2a36c49770fb0fadc5e48e535f0fa58497a9d2753b0f89f74c37ff8dca1890ee
MD5 hash:
15f33451481548e2988eb00e3a6e187c
SHA1 hash:
6cea0df23bbe8257a52482f1a48bd1be3550ab2f
Link:
https://www.unpac.me/results/033b339f-a754-4e9d-8d96-eaaf8b3349f2/
SH256 hash:
c8bdf929006eab870efd452454c9092fb117d757cb15b6c94a528551f411c34f
MD5 hash:
a0f92bee8a3ca383c15565002016cedf
SHA1 hash:
1df98b8874ffd1a1bd7a1f92446043434d2de777
Link:
https://www.unpac.me/results/033b339f-a754-4e9d-8d96-eaaf8b3349f2/
SH256 hash:
1d03149eb8839cefbe072e5fed04a5a775f856b53ffa1373f235a6a5ddceb553
MD5 hash:
e9ae8d2f81cc2981ae784f3648040a92
SHA1 hash:
d9a19d08b817a88feaf08e00eee8a0479663a960
Link:
https://www.unpac.me/results/033b339f-a754-4e9d-8d96-eaaf8b3349f2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/1d03149eb8839cefbe072e5fed04a5a775f856b53ffa1373f235a6a5ddceb553

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/177267/

Comments