MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f531a7a7e0024d96701bd6c09c97cda0e56690deb7b53b9b855017000bf0baa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f531a7a7e0024d96701bd6c09c97cda0e56690deb7b53b9b855017000bf0baa
SHA3-384 hash: 48fa54a5ebd53b7a9b1ce64fbd711a7f26dac2760f7fcaac679cc7f65293d32485b52259cfd05a33e21ecfc7a49cfabd
SHA1 hash: 46dfe591424f1c811c6da80b81ca3962e8667588
MD5 hash: 8deb78e7465c7aa01dce0f7b56afd75a
humanhash: pip-speaker-fish-mango
File name:red.ps1
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:430'444 bytes
First seen:2022-12-07 08:00:03 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:cRRIHFh8pCFAECNTT0vgPq+jscEI+ZVF10o+mjgQrsSJI5ELFTVoZphtyUfku2wy:cPCFST04y+0hVjbihU
Threatray 1'859 similar samples on MalwareBazaar
TLSH T1129420B8B49B89E4F50B9881797CFD650D3231F3DAC91E65432CA5448FE9EA83E4844F
Reporter JAMESWT_WT
Tags:62-204-41-235 ps1 RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.28884.32395.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive gamarue packed powershell redline
Link:
https://www.filescan.io/uploads/639048119a505ad9423dcedf/reports/b1f41647-d11d-4ca8-b420-b32651eb0166/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1109054
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected MSILLoadEncryptedAssembly
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f531a7a7e0024d96701bd6c09c97cda0e56690deb7b53b9b855017000bf0baa/
Threat name:
Script-PowerShell.Dropper.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-11-08 18:59:22 UTC
File Type:
Text (PowerShell)
AV detection:
8 of 26 (30.77%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5jru6t6aasnszybxvwatsl43ihfm2in5n5vhonykuaxaaf7bova._file
Verdict:
malicious
Similar samples:
1c57972fdf93b973eedf51c140f28d41f4dc6bc3501ca37d7f409e41022b80a0
RedLineStealer
208242ee86460f756e007197f574ce7b9855805f9d4bd080b53e01caba3bec1c
RedLineStealer
5367a9a3d01c9f3b3bcce04e72c84a050b4fb09a79b1a917eee1c48825f76308
RedLineStealer
8f4ccb41b24de4d077f55f9f33455424bafa4f7546bc4f55efb77c94f9877170
RedLineStealer
94365d9e2381d5800339362f6bc43fce1136615dc0ac49dae00e094b51e9ff38
RedLineStealer
983b19f3d65f37400eeb404fd838e322041fc26335ed14e08d29addbb87fcea9
RedLineStealer
a96519061c8c1af420d77cff87fcb88f409db5328dac7df3a91c235bc4ee5eec
RedLineStealer
bdc0570be9dff25c0ba52ee4eb285a3ccfa5495bd8d8299fa214fb9a7a4ec918
RedLineStealer
+ 1'849 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221207-jv1gmsca6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f531a7a7e00/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/1f531a7a7e0024d96701bd6c09c97cda0e56690deb7b53b9b855017000bf0baa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments