MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 457aecc9187cb32bf4a2678fdf61450f013a48460d454e986bae391b03b3cb10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 457aecc9187cb32bf4a2678fdf61450f013a48460d454e986bae391b03b3cb10
SHA3-384 hash: 716d9807609e89796048d7fc896812a93bce6f4c9a4e4bf154827d21aa2d62973c7f5219cbf38e605e32e0894970997d
SHA1 hash: 4f6b2bd358aff54c751e9d207d1f15d44c8df502
MD5 hash: 5cb576f09ab492e81baba8441c95fbe3
humanhash: undress-florida-papa-mirror
File name:5cb576f09ab492e81baba8441c95fbe3.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:980'480 bytes
First seen:2020-07-19 09:42:06 UTC
Last seen:2020-07-19 11:11:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8842409b79cba683e95a934245ab3224 (1 x RedLineStealer)
ssdeep 24576:kq6pW+fh9z15jWsUn/w3cCBAfddAy5rGt3xd07J:kPI+fh9XIjCAPA3t3W
TLSH A62523117990CC72F24BD27A5896C6B44B2EB86508B767C63FF6022C6F626C2CF15787
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://45.67.229.57:81/IRemotePanel

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27771/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Connection attempt
Running batch commands
Using the Windows Management Instrumentation requests
Searching for the window
Forced system process termination
Launching a tool to kill processes
Unauthorized injection to a system process
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/389695
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247021 Sample: LYdbQMupV2.exe Startdate: 19/07/2020 Architecture: WINDOWS Score: 80 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected RedLine Stealer 2->29 31 Yara detected MSIL Crypter 2->31 33 2 other signatures 2->33 8 LYdbQMupV2.exe 1 2->8         started        process3 file4 23 C:\Users\user\AppData\...\LYdbQMupV2.exe.log, ASCII 8->23 dropped 35 Detected unpacking (overwrites its own PE header) 8->35 12 RegAsm.exe 15 2 8->12         started        signatures5 process6 dnsIp7 25 45.67.229.57, 81 ALEXHOSTMD Moldova Republic of 12->25 15 cmd.exe 1 12->15         started        process8 process9 17 taskkill.exe 1 15->17         started        19 conhost.exe 15->19         started        21 choice.exe 1 15->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/457aecc9187cb32bf4a2678fdf61450f013a48460d454e986bae391b03b3cb10/
Threat name:
Win32.Trojan.Glubpteba
Create hunting rule
Status:
Malicious
First seen:
2020-07-19 04:06:40 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iv5ozsiypszsx5fcm6h56ykfb4atuscgbvcu5gdlvy4rwa5tzmia._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/200719-7p1tpc7t8j/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of SetThreadContext
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/457aecc9187cb32bf4a2678fdf61450f013a48460d454e986bae391b03b3cb10

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 457aecc9187cb32bf4a2678fdf61450f013a48460d454e986bae391b03b3cb10

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/408894/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/27771/

Comments