MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e
SHA3-384 hash: 582d422870a185089482da45415051ee347cb32c2f756e66221c4ed00bf615fd17b6f05389ca54cb067b65af1ef01899
SHA1 hash: a6530495857371ad151a50f549dacc0ee6f22da7
MD5 hash: e2cbfed6f9d89e8ccdf2b68bf945972e
humanhash: sodium-alpha-lion-maine
File name:yes11.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:836'408 bytes
First seen:2021-09-07 06:26:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:jHlhWIcDriJ4PSArnUI5BfFxnyW87F/suDzQT3U77CaQCMjpT0OKPhz2Gg3:YDOArUIzfP0WuDt7n8x5K5ztk
Threatray 2'240 similar samples on MalwareBazaar
TLSH T13D05E1C332848B44C54858F1C1DF983417F5EEDBAA72D7967E64778E0E62236BD42B0A
dhash icon e2d198b8bc9edce4 (7 x RedLineStealer)
Reporter JAMESWT_WT
Tags:bitbucket.org exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
yes11.exe
Verdict:
Malicious activity
Analysis date:
2021-09-07 07:06:51 UTC
Tags:
evasion trojan stealer
Link:
https://app.any.run/tasks/c943e8c7-2d0e-4640-b9f7-952f1928b55e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/185908/
Detection(s):
Win.Packed.Reline-9891226-0
Create hunting rule

Win.Packed.Msilperseus-9891228-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Connection attempt
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/90605538-08cb-4a05-a077-1677c6ec7693
Result
Threat name:
Ficker Stealer RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/846324
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected AntiVM3
Yara detected Ficker Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e/
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 18:56:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
28 of 43 (65.12%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1f7122b77bd74c1ff7453c77e9d8ef2979cc278a03073035905ef7a46dc8a06e
RedLineStealer
32990d404497c5dada81222c262bbeccac9c6128e8a340ac5424b727073b1f5e
RedLineStealer
90823e9bf099b873263241a2a7c3435b85fe6480ecb4fff4da9563ba95e7b31e
RedLineStealer
b16c67c196a1cc559f521eeac0052b0025b0eac9afdc5a25c6d8d7e7a611b37c
RedLineStealer
cb5b3ec1be5f432cec70fbea8d525210ef25570b56fba33d7da1ccfb70c6c935
RedLineStealer
ea78ed57b3fe52d6863130011feffa4f34422d7a79428f89e22cd2d13f062eb9
RedLineStealer
ebed275eba9f8eddb2242c93732b7a213ede149bd79a792de9d6f8dda6d7f3a3
RedLineStealer
ed3f452a9fed41f5d3dfb528d6c05a53298b559775eeec46eda50ad42a714b28
RedLineStealer
faa254ca57ec7188939dc6b75b65b9e018d3152c5adb2953daaea28fd4044b69
RedLineStealer
fd1950809cc08c90a09af1289b6107d2f86f4873eca54d2ef2baf3a0590a5491
RedLineStealer
+ 2'230 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:0815 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210907-g68w2sfcfl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Looks up external IP address via web service
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.206.212.37:1134
Unpacked files
SH256 hash:
5f1c858e0130e56ec26312f96903738825ab4cdc37378aea325e747b37a949fb
MD5 hash:
5e04bfcfcf2a930283f8b3d163f3207c
SHA1 hash:
28dce4cc6b5d8b7b8dec96554f1ebc7471e438c6
Detections:
win_redline_stealer_g0
Create hunting rule
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
Parent samples :
91d5b0c029a508e2b1926313d9a9cbc3c513ad9be44991fb0954c76bdfd5ce17
5357876b52c2f06284463c50d1cdabbaa0c28209a4ca93a420450faf39046071
1f6c21a3674c9c3ed14e365850725834161ef4cb1c46ba38506b296833d885a2
53a9e47050e900f1a64da983ccf1b07fa505529ff0f83689845b3ca774ed8608
284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e
381ae37b8ac16db49c8293b24ea7f7c8e88219bdb79e78d240a4acd2d9e88f30
5af3e4db30f3d1b17ff78e22ee9aad84f21704fd5b59fa68a24f47a684f52365
SH256 hash:
3de646116eea5962c59f1bed100ef8f7ab284f491b81dede169634508ef5027e
MD5 hash:
f080d3fb3818861b0e100888755862c8
SHA1 hash:
222e5141b89f084d1337c086d16573cf3d09002f
Detections:
win_redline_stealer_g0
Create hunting rule
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
Parent samples :
91d5b0c029a508e2b1926313d9a9cbc3c513ad9be44991fb0954c76bdfd5ce17
5357876b52c2f06284463c50d1cdabbaa0c28209a4ca93a420450faf39046071
1f6c21a3674c9c3ed14e365850725834161ef4cb1c46ba38506b296833d885a2
53a9e47050e900f1a64da983ccf1b07fa505529ff0f83689845b3ca774ed8608
284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e
381ae37b8ac16db49c8293b24ea7f7c8e88219bdb79e78d240a4acd2d9e88f30
5af3e4db30f3d1b17ff78e22ee9aad84f21704fd5b59fa68a24f47a684f52365
SH256 hash:
e3e66f7af4f0170fa34dca4e71c999f0f9261470234cec6c5863aebb6d5dd3c1
MD5 hash:
ce72c7812dd7d09538c4e6ae94fc1f29
SHA1 hash:
908f0558c4ab9d0ac8cdc202809661edc8719fe9
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
SH256 hash:
adeb87a4f62ff9aaeb3d655e11e3372c550199641b003f2d61d9d7cb682b2594
MD5 hash:
3a829c3392a64eeb2e3b1c53c0e4e257
SHA1 hash:
764efd027c09526ce89980abd194a80393f6c056
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
SH256 hash:
ec5cb2a794b214da777b08f49e88413c232fdb5f9c65f139511481a3e05f942b
MD5 hash:
b2a2792143c6f437c7148aaeda31cd08
SHA1 hash:
6270583f97842f5336f26c6b1c36c1f38349d68f
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
SH256 hash:
c22ec624753ad0318321bac51b29712848d63bad1e5bb77885231a0e733b4f66
MD5 hash:
d48417cb5c88604dddb985710308c84c
SHA1 hash:
3ebdf98211e00c353e742156ab92441da8770f48
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
SH256 hash:
284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e
MD5 hash:
e2cbfed6f9d89e8ccdf2b68bf945972e
SHA1 hash:
a6530495857371ad151a50f549dacc0ee6f22da7
Link:
https://www.unpac.me/results/0945815f-80f4-4d46-a927-92b81e518f2c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/284fa9b7685e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/284fa9b7685ebc3e71cf5d9956abe26103c8d9bafc29d3d417d4924dadfec00e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/185908/

Comments