MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26d55decc67666ada2fef985a64ea76a5f41189bef2960dcaf1c2dc2f31d0006. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	26d55decc67666ada2fef985a64ea76a5f41189bef2960dcaf1c2dc2f31d0006
SHA3-384 hash:	b5beb7a9a29a0b0787a8fb3dd6d1e2c7787adb548eae4b07aacee56390aa6d6911eac3d1990a163d0ddf59d578ac4a4d
SHA1 hash:	fbed9db8d3ccd327f3ca7281c38d133d3ff8f11b
MD5 hash:	f82573d95f6733bee4f0707e9d92c002
humanhash:	echo-angel-uniform-purple
File name:	f82573d95f6733bee4f0707e9d92c002.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	330'240 bytes
First seen:	2021-04-22 06:14:28 UTC
Last seen:	2021-04-22 07:19:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4cb9d63f797831e593075010586be1d1 (2 x RedLineStealer, 1 x TaurusStealer)
ssdeep	6144:DFvNIyHr4lbLqobCfsxNnvp1f+KfxnEQLrqIl811NRzBWv:DLIysbVbCUxNnvmoxnPgB
Threatray	504 similar samples on MalwareBazaar
TLSH	3364CF1072E2E132E1A215B5C725C7B14AFB787629396D8FBBC01B790F217D3DA1630A
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f82573d95f6733bee4f0707e9d92c002.exe

Verdict:

Suspicious activity

Analysis date:

2021-04-22 06:33:15 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/bd494e4c-fddb-47dd-8f89-d86a77a86e90

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/143536/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46148099.29670.15921.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/692484

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/26d55decc67666ada2fef985a64ea76a5f41189bef2960dcaf1c2dc2f31d0006/

Threat name:

Win32.Backdoor.Convagent

Status:

Malicious

First seen:

2021-04-21 21:02:48 UTC

AV detection:

13 of 28 (46.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=e3kv33ggoztk3ix67gc2mtvhnjpucge354uwbxfpdqw4f4y5aada._file

Verdict:

malicious

RedLineStealer

2efb4d4bb7e9141474ee5ae3f8c40274c5ab675b33836ac31a8ec554dd76a9bf

RedLineStealer

42b653a004ebf20afd1797fa69fe13dc18c07281befd059d21c3f5f994b33723

RedLineStealer

667d6191eab21dca3a07f01b287a4a4d35c719885b712eeaf3fedeeeb8b16e4f

RedLineStealer

76b9e7cad6719da5975a769160602a67877e0e1748375280831f1f25b4558f48

RedLineStealer

7b9bd29f5c0787b2937b34493ca5a7128d476dc9f4257643f1fd47d48399eafa

RedLineStealer

7ba598295df994536137bc987b00344e609035b56a40c93354cde719cd4a2989

RedLineStealer

bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e

RedLineStealer

f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa

RedLineStealer

f3ec960fde547dac872a3fe8ee59c3beb063457673fcf50480e20c886c7f17fa

RedLineStealer

+ 494 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:118 infostealer

Link:

https://tria.ge/reports/210422-wvrfhnx6l2/

Behaviour

Suspicious use of AdjustPrivilegeToken

RedLine

RedLine Payload

Malware Config

C2 Extraction:

bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/26d55decc67666ada2fef985a64ea76a5f41189bef2960dcaf1c2dc2f31d0006

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekshen
Description:	Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 26d55decc67666ada2fef985a64ea76a5f41189bef2960dcaf1c2dc2f31d0006

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1147433/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/143536/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-22 07:21:30 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0003.002] Communication Micro-objective::Connect Pipe::Interprocess Communication
2) [C0049] File System Micro-objective::Get File Attributes
3) [C0051] File System Micro-objective::Read File
4) [C0052] File System Micro-objective::Writes File
5) [C0007] Memory Micro-objective::Allocate Memory
6) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
7) [C0040] Process Micro-objective::Allocate Thread Local Storage
8) [C0041] Process Micro-objective::Set Thread Local Storage Value
9) [C0018] Process Micro-objective::Terminate Process