MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2ec7c847f0688dff3229c676bb15e88e1c576bcb67157341887ffc3a20375190. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 10
| SHA256 hash: | 2ec7c847f0688dff3229c676bb15e88e1c576bcb67157341887ffc3a20375190 |
|---|---|
| SHA3-384 hash: | 75ef86f214be8122e25fb09bd30a2e5034537a017f0f603c435d25c3f2344bb01e4c544201894dba9ee2507e5f448260 |
| SHA1 hash: | 84505c3ae38421fa4dc6017c8d7e27e9b106cdc9 |
| MD5 hash: | 1c55d28dcdcf93370495635d3d64e2fd |
| humanhash: | mirror-india-papa-uniform |
| File name: | 1c55d28dcdcf93370495635d3d64e2fd.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 391'680 bytes |
| First seen: | 2020-12-07 19:18:11 UTC |
| Last seen: | 2020-12-07 20:38:07 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 2af0e18fcdc1fd07a460ae34537d4b16 (1 x RedLineStealer) |
| ssdeep | 6144:N1OtlrYH8rmHLR1oqQzDtH3CKSS3G2eAe6J8zsFfjak7qvDY0sZChCK:3WlprmHFyq+N31SS3GzAe6J8zE+UqgEj |
| Threatray | 168 similar samples on MalwareBazaar |
| TLSH | CA84DF023690E073C15569315921C7B58A7EBC7069155E0BBFC9BEBE2F347E3D6A230A |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1c55d28dcdcf93370495635d3d64e2fd.exe
Verdict:
Malicious activity
Analysis date:
2020-12-07 20:20:03 UTC
Tags:
rat redline trojan evasion phishing
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
DNS request
Sending an HTTP POST request
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a file
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Glupteba
Status:
Malicious
First seen:
2020-12-07 00:25:20 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 158 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:agenttesla family:redline discovery infostealer keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Looks up external IP address via web service
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
RedLine
Unpacked files
SH256 hash:
2ec7c847f0688dff3229c676bb15e88e1c576bcb67157341887ffc3a20375190
MD5 hash:
1c55d28dcdcf93370495635d3d64e2fd
SHA1 hash:
84505c3ae38421fa4dc6017c8d7e27e9b106cdc9
SH256 hash:
9c8fdb790fcea764ede30a0bf1baef5c02877b55be5306f01e4adc7e0cfe63f8
MD5 hash:
6b48bbb31ce92c2f960fd5b23c680f6e
SHA1 hash:
0ce63eea9942a08f8a1bcf1e7c8bc0b68683659c
Detections:
win_redline_stealer_g0
SH256 hash:
479978b70408563ed6b3e90834c07a5120cb765a297cffe27f0ede3dff5850ed
MD5 hash:
d0cce6f0fbb19f92461d34edbc8b5ec6
SHA1 hash:
af858cd7205c79d8495c293439d9838a5fddf8ac
SH256 hash:
483b56d648af330bf2fbf69745ac9f7fe483ba1f207eb479ff54cf7e3975f3f1
MD5 hash:
7356752a74682cd36e10a22bb7f5746d
SHA1 hash:
bd6eb04aa77089dfdda5a7b42c0262af99c4db80
Detections:
win_redline_stealer_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.