MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ae247a672b60ac889f44ea5488143ada2f0d6cfd00141de95c646b7ed401b27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ae247a672b60ac889f44ea5488143ada2f0d6cfd00141de95c646b7ed401b27
SHA3-384 hash: e4d193645110bb456c24a6bfb4cfd692b7423d2a5cf363f17010066aabf9969f9af1ec416ffc2e0a4b498f5f2273465d
SHA1 hash: 6400232d030924220f5bc7405d3a03dbfc9436b6
MD5 hash: d59796ff173a9277adb51ac3b8972f19
humanhash: freddie-pluto-angel-diet
File name:Loader.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'263'104 bytes
First seen:2021-07-16 08:29:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:SkuZncoefc4B/tCpPoO5bdxlhmQ7vztme1LNfr4/fqPmwuuk2YXfdmeV72aTEXTa:SkYcobaUpAQdxlhN7vzn1J0las6aVZ
Threatray 29 similar samples on MalwareBazaar
TLSH T1BA451C1E5B5BADA3EE0E02F3B3740A405B36DE5FEA00ED5BA75067D9A38ED035C441A4
Reporter Anonymous
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Loader.exe
Verdict:
Malicious activity
Analysis date:
2021-07-16 08:32:36 UTC
Tags:
trojan stealer covid19
Link:
https://app.any.run/tasks/27fc4b3e-6239-4573-a44f-4a2dd8ba6e17

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Predatorthethief
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172143/
Detection(s):
Win.Packed.Bulz-9875331-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4f778faa-139a-4192-b15b-e1f51374a411
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/817358
Signature
Connects to a pastebin service (likely for C&C)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ae247a672b60ac889f44ea5488143ada2f0d6cfd00141de95c646b7ed401b27/
Threat name:
ByteCode-MSIL.Ransomware.FileCryptor
Create hunting rule
Status:
Malicious
First seen:
2021-07-12 09:45:58 UTC
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0e2fce48323652f4be8408c1ab8b1565e40fe120f712127d2ab73c67167cce06
RedLineStealer
36efcecbeb3a5c3de9a03ba9b68657f9da7b16e97e812e8e73f5faa7006fa01e
RedLineStealer
3acd39bfeaeaccd9154bbe57640816ed3353bbe27a33babe07fe242beedf08e4
RedLineStealer
4a2708b03dc190d7a2bb26c5ebcbd380ddc2d21f5bd8991be7f581d8b8e79737
RedLineStealer
71b928fd0b29e21bbfa4755b5347f4dc40653a82ec7ecf4947e325dbec23abaa
RedLineStealer
84b4de2aa2a30edc31ad72fd35b012d54c8aac112c48abe1cfc434a9fb57511f
RedLineStealer
ab960c72ea326f3f979e1abd0e589a1d20ee65b5fb5552842ffc842a406d6a69
RedLineStealer
d33a4d3ac76095145e6061009fc20432b5c2c6ec4a828c7b6956ea5f072f2c34
RedLineStealer
ebd46183b53aca011bbd1c430296089477faf2e2130e8d9da3c633f9a38e3488
RedLineStealer
f87ed79fbb1a2228c97fb59127eade39c4f8218fa28ddd76b50da177d81438e3
RedLineStealer
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/210716-eb74d5enqn/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Deletes itself
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
4ae247a672b60ac889f44ea5488143ada2f0d6cfd00141de95c646b7ed401b27
MD5 hash:
d59796ff173a9277adb51ac3b8972f19
SHA1 hash:
6400232d030924220f5bc7405d3a03dbfc9436b6
Link:
https://www.unpac.me/results/34245163-ac66-489c-bfa2-72129af048d4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/4ae247a672b60ac889f44ea5488143ada2f0d6cfd00141de95c646b7ed401b27

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172143/

Comments