MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 290203682933bc641f5a7a75e75efc475476c028031bdbd77dcd15a2daea536d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments 1

SHA256 hash:	290203682933bc641f5a7a75e75efc475476c028031bdbd77dcd15a2daea536d
SHA3-384 hash:	f508016c99b131def65009b7a1696a9c70353ee79a43c2f65b37374e6c839f56c82a84f3283559d81d212b6b80926676
SHA1 hash:	8fd415729ab2ba434195c8985717b60914b270c8
MD5 hash:	4921248519ec4f1df0df4f962cf62c0e
humanhash:	mango-fix-thirteen-arkansas
File name:	รหัส _txt.Scr
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	105'984 bytes
First seen:	2021-06-14 04:45:23 UTC
Last seen:	2021-06-14 05:51:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'302 x AgentTesla, 20'721 x Formbook, 12'402 x SnakeKeylogger)
ssdeep	1536:oCrvtvoUQHsIMqck7G0zRIytFfkhHUz2EPeUYs9a3SL:oa5QMIMqLi0tZtNk1Uz2EPeUYg
TLSH	A2A32861E28C7CE4C01746BBEC34FA08212BF74A452D495A79B6B51E64B22C374B7E4F
Reporter	ankit_anubhav
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

รหัส _txt.Scr

Verdict:

Malicious activity

Analysis date:

2021-06-14 04:48:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/80f57f9d-3e4d-4d00-b8a9-5192791a3b8b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.MulDropNET.12.19722.3031.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Creating a process from a recently created file

Creating a file

Creating a process with a hidden window

DNS request

Connection attempt

Sending a UDP request

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0fc01bea-4ac7-4495-beb7-c5879b93a63e

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/801479

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Bypasses PowerShell execution policy

Detected unpacking (overwrites its own PE header)

Uses dynamic DNS services

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/290203682933bc641f5a7a75e75efc475476c028031bdbd77dcd15a2daea536d/

Threat name:

ByteCode-MSIL.Trojan.Ursnif

Status:

Malicious

First seen:

2021-06-14 04:46:10 UTC

AV detection:

26 of 46 (56.52%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/210614-gx6vw42aqx/

Behaviour

Modifies registry class

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Blocklisted process makes network request

Executes dropped EXE

Unpacked files

SH256 hash:

a6dc9aa6fd7d1d82226c14ae80fe8c94f836ef685e9f323981ca90fa20665345

MD5 hash:

e0e34ce29a2423742b8e56ba94797cd9

SHA1 hash:

6d0a4f210c9fa6f61167eae4832c7883a67bb0b6

Link:

https://www.unpac.me/results/02da645c-0a8e-4352-aa90-295ab3a278f0/

SH256 hash:

290203682933bc641f5a7a75e75efc475476c028031bdbd77dcd15a2daea536d

MD5 hash:

4921248519ec4f1df0df4f962cf62c0e

SHA1 hash:

8fd415729ab2ba434195c8985717b60914b270c8

Link:

https://www.unpac.me/results/02da645c-0a8e-4352-aa90-295ab3a278f0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/290203682933bc641f5a7a75e75efc475476c028031bdbd77dcd15a2daea536d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Ankit Anubhav commented on 2021-06-14 05:29:53 UTC

Can confirm it is H Worm. https://www.dev-point.com/vb/threads/693276/