MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27bc6cc40be62fbfdfc9ba924ea338356cc5a6058640bb7485998f4f99c57897. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27bc6cc40be62fbfdfc9ba924ea338356cc5a6058640bb7485998f4f99c57897
SHA3-384 hash: eb9354395b3b4dcafba9d1eec631b41e20682c3270d29a852dfa2b1e8480dc5a981107e586fbf563b39a9f5a9b89cd45
SHA1 hash: 9c06c08d83749c21f7e347956285ddcf7fca9ca5
MD5 hash: a5688f035280d66b55d34431cbba1c5a
humanhash: foxtrot-thirteen-alaska-kansas
File name:a5688f035280d66b55d34431cbba1c5a.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:44'032 bytes
First seen:2021-03-21 07:30:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:PuJTjvyhO08tijzLKH1kNx8bQW4/vwoAntsB/EidfcwlQn01e:PuJehO08E3mVkNybQW4/vwo05iVcW2
Threatray 74 similar samples on MalwareBazaar
TLSH 0E135C2173ADCA3FE6AF57B8F8B151910370D6DD3113E7E68DD8A2596893B4406223B3
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a5688f035280d66b55d34431cbba1c5a.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-21 07:32:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e6941274-ee5e-4b08-bf3d-783ed8200597

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Malware.Filerepmalware-9841599-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Sending a custom TCP request
Launching a process
Creating a file
Connection attempt
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a2b5e55-baae-4bd1-83d5-ff52643925b5
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/647027
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27bc6cc40be62fbfdfc9ba924ea338356cc5a6058640bb7485998f4f99c57897/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-03-15 09:10:50 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e66gzral4yx37x6jxkje5izygvwmljqfqzalw5eftghu7gofpclq._file
Verdict:
malicious
Similar samples:
0ebab35c1d6c8bdfc810aa740f9038ce35e578d294c70df70686a3a3082d8332
RedLineStealer
1bbbf691fab9190327d56aab3b93b70ef2b35353dcde740908c384ade4c7e6a9
RedLineStealer
24062475819e3e3d53f878c623cebe93d05a21966fb6493c1cdf25b19053c88e
RedLineStealer
3b6533fc2c7b1b192c3111d6cb5558c40dec8050ebe2162c006ebc39732f2f73
RedLineStealer
41ff1e7d1148b7336cec20f3d4962a0bfa978b4d90b465a9706d1599ff10e2c2
RedLineStealer
6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787
RedLineStealer
746b6f97ac17b501a455bb1570a10515bf83db24890f39e02b2c2e0b09bf7f0d
RedLineStealer
834feb87d58ce3fa6ab779e6ddbf0e920bc94ec4d001e9af25d503bf00422607
RedLineStealer
d1597e584fec8eb356aa5c831045b2ce68531e69fe70436fa3ca0d8dd1d90ca7
RedLineStealer
ef42ae97b53c0b06baab4e16b5348303ecf1d29db894bd857b63111e387235a5
RedLineStealer
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210321-qd2yljqbax/
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
27bc6cc40be62fbfdfc9ba924ea338356cc5a6058640bb7485998f4f99c57897
MD5 hash:
a5688f035280d66b55d34431cbba1c5a
SHA1 hash:
9c06c08d83749c21f7e347956285ddcf7fca9ca5
Link:
https://www.unpac.me/results/7ff4d39d-c20c-4c4a-9ee9-fa45bf287634/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27bc6cc40be62fbfdfc9ba924ea338356cc5a6058640bb7485998f4f99c57897

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments