MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 432f73d48d14e627171a6b36cf48de0dc130da68379ab834b29c7a1d00bf212a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 432f73d48d14e627171a6b36cf48de0dc130da68379ab834b29c7a1d00bf212a
SHA3-384 hash: 47c220a272116f37161ea8b086320194ae7864888c0bfc2f57cc20bcf6355d84c39edef4f719552c12c92615f938c5fb
SHA1 hash: bacf33e7116b7f805cd12dfa32409a8d374b3cd7
MD5 hash: bde346cc934a611d65f65992a1eed413
humanhash: moon-alpha-illinois-yellow
File name:bde346cc934a611d65f65992a1eed413
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'131'392 bytes
First seen:2021-07-04 05:19:32 UTC
Last seen:2021-07-04 05:36:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:uk1XoT9OEjQbodCU7VHlcWk+yjhOssmlBHrLq7NiB5YHb9v95pjSoMYcYn7Du:91XMCQLcXthOjmHC7gE7x9Ljc
TLSH 65E5D0226311CE1AC3D52AF961A7411C8774D163B316BB0F1FBDE1667DE22B48E423DA
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bde346cc934a611d65f65992a1eed413
Verdict:
Malicious activity
Analysis date:
2021-07-04 05:21:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d112046f-2cc3-405e-974d-9f77e62558dc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169541/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader40.24717.23883.32315.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e25f7f61-97cd-441f-b058-c829fb1dbcfd
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/811499
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 443910 Sample: i2tIhMHBrK Startdate: 04/07/2021 Architecture: WINDOWS Score: 64 26 Multi AV Scanner detection for submitted file 2->26 28 .NET source code contains method to dynamically call methods (often used by packers) 2->28 30 .NET source code references suspicious native API functions 2->30 32 Machine Learning detection for sample 2->32 7 i2tIhMHBrK.exe 14 3 2->7         started        11 i2tIhMHBrK.exe 1 2->11         started        14 i2tIhMHBrK.exe 2->14         started        16 i2tIhMHBrK.exe 2->16         started        process3 dnsIp4 24 176.111.174.107, 49743, 80 WILWAWPL Russian Federation 7->24 34 Uses schtasks.exe or at.exe to add and modify task schedules 7->34 18 schtasks.exe 1 7->18         started        22 C:\Users\user\AppData\...\i2tIhMHBrK.exe.log, ASCII 11->22 dropped file5 signatures6 process7 process8 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/432f73d48d14e627171a6b36cf48de0dc130da68379ab834b29c7a1d00bf212a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-04 00:22:10 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210704-lavqagsc1n/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
432f73d48d14e627171a6b36cf48de0dc130da68379ab834b29c7a1d00bf212a
MD5 hash:
bde346cc934a611d65f65992a1eed413
SHA1 hash:
bacf33e7116b7f805cd12dfa32409a8d374b3cd7
Link:
https://www.unpac.me/results/8aa8680c-e756-46d2-a488-a4b25937d628/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/432f73d48d14e627171a6b36cf48de0dc130da68379ab834b29c7a1d00bf212a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 432f73d48d14e627171a6b36cf48de0dc130da68379ab834b29c7a1d00bf212a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/169541/

Comments


Avatar
zbet commented on 2021-07-04 05:19:34 UTC

url : hxxp://176.111.174.107/Api/GetFile?id=needbild/