MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c
SHA3-384 hash:	53c0f6951dd6c426948a948582a5923252b29e1bb88d6535b0f1d3909bc0975f4ef47c185ae3f2f3c5a34cef138e3d0b
SHA1 hash:	bd62756f0c9a7b1351d95a4f89e4a2703fe3e8b1
MD5 hash:	8eac2855d5a48ec13d6d71a463f40e27
humanhash:	artist-skylark-aspen-bacon
File name:	Canva Setup 1.65.0.bat
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	182'789 bytes
First seen:	2023-05-19 16:47:24 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	3072:ySP4raypoA8VXIUrjXqRWqdFzcvV55hXyivw80Bc+werehaGp2Okk61qFYLk:RPQ+hqseRWqdw5TV4xCtmelp2Okk61ql
Threatray	385 similar samples on MalwareBazaar
TLSH	T1320412FDF3407BE80FD9CB5ED9102B4DC1D249A918E792B200D59A29F3AD2ADC6C4C46
Reporter	gurulemo
Tags:	AsyncRAT bat Redline RedLineStealer

gurulemo

.bat file that downloads and executes RedLine Stealer and AsyncRAT. Found on a Facebook malvertising campaign distributing those malware. Downloaded from "https://canvapc-download.com/"

Intelligence

File Origin

# of uploads :

# of downloads :

202

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

https://canvapc-download.com/

Verdict:

Malicious activity

Analysis date:

2023-05-19 15:37:42 UTC

Tags:

redline asyncrat rat

Link:

https://app.any.run/tasks/1620fcb1-9968-421c-9d88-c89ea0f547bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6467a842dc2e9b51cb9d76a3/reports/33c7ae32-4c97-48fd-bdd1-dbd3c148fe19/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1237419

Signature

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Very long command line found

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h24z76dv3u4xww7o2exdmyuyjtck7xvc75uzqfk3tr2inecq3e6a._file

Verdict:

malicious

RedLineStealer

9616a9ed1fb31b9f760267564a37ec8175e5f8adee180823042f50ab191189b9

RedLineStealer

963d62811b21dd7a9716c812303db3c717d5287e9b8fe0266084de98649de6b4

RedLineStealer

9e66488d7666de3a0a23a83f9564e817763d03e26129e9c298de265501d5d913

RedLineStealer

a1e645b31ee112fee86474a6620ba9ad4ba5ab301d1af7599a2281af23460b5b

RedLineStealer

a24ac3a139c0635c9731a068cdd537985a690923e5626229cd47fbc675b904f1

RedLineStealer

b232bec4aabb5a5914ec2601812534758598f8b745dabd15acabfb2cb176e246

RedLineStealer

c8b7fc073f9b19aa83d4e2ad4945a6de2e82cf7bce58c41e38c804c61fe92eca

RedLineStealer

c9f66b18443cd4fd5343d53905a7b96506e19543fc0521727e58d80c604baee2

RedLineStealer

fe80bfb679c9884cd19c2052a41dff9548673a7ef71f691f4621e0adee488ecc

RedLineStealer

+ 375 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/230519-va3xtahe6y/

Behaviour

Modifies registry class

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3eb99ff875dd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	adonunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AD on UNIX

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

bat 3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c

(this sample)

any.run

https://app.any.run/tasks/1620fcb1-9968-421c-9d88-c89ea0f547bd/

Dropping

RedLine

Dropping

AsyncRAT

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample