MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ffab72b36cf2a163375255770d4ba2e95043e3eeeee0acf3c905618b718d83f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ffab72b36cf2a163375255770d4ba2e95043e3eeeee0acf3c905618b718d83f
SHA3-384 hash: cda8da14730ed5f4ac2058b2becc0bae6cf829b189bcea1b040dfe5398257c74592eda9a9507b2d5c1bc0b2087fc27f6
SHA1 hash: 3b67a1d83c6df59417a6ab614f4748a2e10672b6
MD5 hash: a953bea3131d0014e1b81edc83827a7e
humanhash: romeo-alpha-glucose-oxygen
File name:1ffab72b36cf2a163375255770d4ba2e95043e3eeeee0.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:36'088 bytes
First seen:2021-04-21 06:36:38 UTC
Last seen:2021-04-21 08:02:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:d14XRu2dYHEyJoRSNVrT2PPGAMCtMWGixPIJ3VOFHFwcMc0utRIALhU7:d10RuK7PONbix83AlF6BeLhI
Threatray 261 similar samples on MalwareBazaar
TLSH 0EF209671560708AE9974A741D52ED343A28EB705C80D20FE426961CCFC67BF34ED9EE
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
51.254.187.177:3705

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
51.254.187.177:3705 https://threatfox.abuse.ch/ioc/9343/

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1ffab72b36cf2a163375255770d4ba2e95043e3eeeee0.exe
Verdict:
Malicious activity
Analysis date:
2021-04-21 06:38:45 UTC
Tags:
trojan dtloader loader rat redline
Link:
https://app.any.run/tasks/a49cec85-1816-47ef-bdf7-504de4011a28

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/141841/
Detection(s):
SecuriteInfo.com.ArtemisA953BEA3131D.27734.3938.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file
Sending a UDP request
Unauthorized injection to a recently created process
Sending an HTTP POST request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Stealing user critical data
Sending an HTTP GET request to an infection source
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ffab72b36cf2a163375255770d4ba2e95043e3eeeee0acf3c905618b718d83f/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 07:06:49 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d75lokzwz4vbmm3vevlxbvf2f2kqipr653xavtz4sblbrnyy3a7q._file
Verdict:
malicious
Similar samples:
308087aed8b1e2e06ca043977cbbf86dfa5616ab76cd2a7b9a1ae48b747767aa
RedLineStealer
6e8a0a30744ed0130a2b32997e03ba5c07339ddf22e76c7ca64882d5d3f8cc4f
RedLineStealer
8cfbe99de13e5eec5ef9e5ce5b6f66412b65be60db48515ac9cb26a6aac4291a
RedLineStealer
90a286ac5b49100aeb8038af277dbabc3853e6fe5557c19d5a64885f015596b1
RedLineStealer
92f38b474f16faa935aa1976979c81fbc9c296e584d86fd8b9c7c8751c1a968f
RedLineStealer
98c61b84f915ff63f9d5677d1ee53e1fb8aff4567eda30a374321424875dd913
RedLineStealer
9a0d57d82e15f4f45a2442d1d5355242a0fe4684039777025622dfa95a8caeec
RedLineStealer
bc5e3b9e7638a68bbb36387281fedc1bedb12d67575b9242a47c0bf0c8f3c265
RedLineStealer
c954ae080338f706fc7490498f532dd18258d15609d45c4992baf2ef9cd36cc7
RedLineStealer
e578c441df91736e8ccad4ee9a3f94a628a281e62e4f9c8dbb0f1f615831b557
RedLineStealer
+ 251 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@sultontheslayer discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210421-m6xs26n7gn/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
51.254.187.177:3705
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1ffab72b36cf2a163375255770d4ba2e95043e3eeeee0acf3c905618b718d83f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/141841/

Comments