MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c913a1db7ff325a6670e0c7a43aef281ba91ce934b911af2858b3b40d266190. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c913a1db7ff325a6670e0c7a43aef281ba91ce934b911af2858b3b40d266190
SHA3-384 hash: 5276e88c8a0555bb036249f9895a26b7e4754c74555338a584e8bae8bb551d4fb961dd0fdcb4c6287d6f41e55ac8a86d
SHA1 hash: eb9b0b4267ce8d5a42af6ddb7ae184b7f10cf414
MD5 hash: e5d9d3e54ad6de4914eb6616193422c2
humanhash: oxygen-item-lactose-pasta
File name:SecuriteInfo.com.Trojan.PackedNET.540.1271.31865
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:944'704 bytes
First seen:2021-02-23 16:01:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:EieuVdXzohToXZzGF8KiBFcaadGTtu3DydhA95Bu5:ENuVdXPZzqhirc3dSri5Bg
Threatray 10 similar samples on MalwareBazaar
TLSH 28159DE1A194D6A1EABCB7F0A451A42013FA2C68DB83C90E7DFA32751472F43DD1725E
Reporter SecuriteInfoCom
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/118701/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.540.1271.31865.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/615696
Signature
Binary contains a suspicious time stamp
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3c913a1db7ff325a6670e0c7a43aef281ba91ce934b911af2858b3b40d266190/
Threat name:
ByteCode-MSIL.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2021-02-11 00:46:08 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
035a62c9a13176755bbe5ea0d9c8a609c9f237a6e0af811abb934ca8654eb753
RedLineStealer
03a7c8a4e67e6739db52502fb4babb8421059e3269610dbec749b3f0aa4a4641
RedLineStealer
11b82240c0a2fbb5f71aefab2266d18d28746ffc267b585f72498006a57aa6bd
RedLineStealer
363f1e19af5976e6c19e76c71e98c405b227938e261beb7e2a0bcc27e4a44be7
RedLineStealer
60d5a2df12e7d3ec47a29b7f1d2faeaa078f89cc3ec6da3965a14a6c1c11de74
RedLineStealer
9866933cc0ecf8e3ddfa7ce79cdbc70b16efbe819a2426ffa28d923a12c0653a
RedLineStealer
b2b25365ac3fab2649ba188a0c113a558686c049d89bb4b8f3d7439a6e6732c0
RedLineStealer
caee9387d7ef6216014c68f4acb557c2eaee0b6e9dd79141288eb1d9d06bf30c
RedLineStealer
e4179e2d5b9c04e7a59bf9b063c006f5695b5ec90600833006d38129ad0a48a6
RedLineStealer
fc243975dc04f097ddfbaf8f3245cd17b7967811b97c926fff0c52749e844480
RedLineStealer
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer
Link:
https://tria.ge/reports/210223-ay7ches456/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
RedLine
RedLine Payload
Unpacked files
SH256 hash:
24a8956556714791051da664c4da9ea863d8d4aaf2f88e3628ce90847d0c399d
MD5 hash:
962cb8975e2212fd9c0c648b4f323865
SHA1 hash:
fba071070f50767da3ab99af1a7b1e937333fb40
Link:
https://www.unpac.me/results/e6e6a053-10b3-4baf-932d-80fdbb36e8de/
SH256 hash:
3c913a1db7ff325a6670e0c7a43aef281ba91ce934b911af2858b3b40d266190
MD5 hash:
e5d9d3e54ad6de4914eb6616193422c2
SHA1 hash:
eb9b0b4267ce8d5a42af6ddb7ae184b7f10cf414
Link:
https://www.unpac.me/results/e6e6a053-10b3-4baf-932d-80fdbb36e8de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/3c913a1db7ff325a6670e0c7a43aef281ba91ce934b911af2858b3b40d266190

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 3c913a1db7ff325a6670e0c7a43aef281ba91ce934b911af2858b3b40d266190

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1025520/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/118701/

Comments