MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e
SHA3-384 hash: 7834beaf79c6f6d30d3d32900ce49a92c96639b2898850a70a89bbe952591f682ed3ef097658592690d11cb226afe006
SHA1 hash: ed250d6235695ab908c4c185cd947bbd7463decb
MD5 hash: 6a0077f386eaf9f87b5f1d4abc53099e
humanhash: zebra-social-zulu-zulu
File name:o20127074.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:180'938 bytes
First seen:2023-05-13 22:54:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf5a4aa99e5b160f8521cadd6bfe73b8 (434 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep 3072:CDKW1LgppLRHMY0TBfJvjcTp5XfUy6hDwe:CDKW1Lgbdl0TBBvjc/sBD
TLSH T111049D2175C0C1B3C4B7113444E6CB799A7A30610B7AA6D7BBDD1BBA5E213E1A3362CD
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter JaffaCakes118
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
o20127074.exe
Verdict:
No threats detected
Analysis date:
2023-05-14 00:15:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a4f6050d-c845-42ef-94ec-062606ace304

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/389163/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Sending a custom TCP request
Creating a file
Blocking the Windows Defender launch
Disabling the operating system update service
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/84010/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
EnumerateProcesses
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed zusy
Link:
https://www.filescan.io/uploads/6460154e446f9ce94a65a9e9/reports/1a7a1e08-6704-4183-bf98-b8029a65a181/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/22ea295c-30fd-44b2-aaa3-75ac6b47cfc2
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1232418
Signature
Antivirus / Scanner detection for submitted sample
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2023-04-30 05:04:08 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7m67o3pp7v2pk3ltx55c54hjmdo2m565fgcghy7irtdepplxcpa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/230513-2vrhvacb21/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Windows security modification
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
f3df0d29138b19fbd0869474e7060f3dc79aa16f6467043b338a86c5b534e1e4
MD5 hash:
3560774b39ee53a53252760a26e5ff0e
SHA1 hash:
d6d9d4a3d66ca2b83ffee3f3a781cfbdd3653533
Detections:
HealerAVKiller
Create hunting rule
Link:
https://www.unpac.me/results/8fa299ed-a9be-44ae-ab38-238b919cc943/
Parent samples :
1bf8638a91190e3d6107b1943fb70168db47f5ce320ca582217989bfd052d1ea
eaafd7f78486e0c2e91d8e0fe27b7cfc73dcbc5b470182065da6c0883f77dc64
3ca8b997fbacea025d3790095e72529710db3493ec8bc66de19ff5c5469f0cca
2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e
SH256 hash:
2471473709c9c56a4fdfee2420ead9dd1604b66e8352e5e5686723629d1d77f7
MD5 hash:
ffbd3831141f5a446ec7513a950ca4a0
SHA1 hash:
a0367cbf08e6d9ac8ef1e4ec30aabf1444bf7374
Detections:
HealerAVKiller
Create hunting rule
Link:
https://www.unpac.me/results/8fa299ed-a9be-44ae-ab38-238b919cc943/
Parent samples :
1bf8638a91190e3d6107b1943fb70168db47f5ce320ca582217989bfd052d1ea
eaafd7f78486e0c2e91d8e0fe27b7cfc73dcbc5b470182065da6c0883f77dc64
3ca8b997fbacea025d3790095e72529710db3493ec8bc66de19ff5c5469f0cca
2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e
SH256 hash:
2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e
MD5 hash:
6a0077f386eaf9f87b5f1d4abc53099e
SHA1 hash:
ed250d6235695ab908c4c185cd947bbd7463decb
Link:
https://www.unpac.me/results/8fa299ed-a9be-44ae-ab38-238b919cc943/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2fd9efbb6f7feba7ab6b9dfbd177874b06ed33bee94c231f1f4466323debb89e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/389163/

Comments