MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ef2301fc3da6b681932cd7a7d32fa6a86800651976a1b9a847864a65f6234f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	4ef2301fc3da6b681932cd7a7d32fa6a86800651976a1b9a847864a65f6234f8
SHA3-384 hash:	63d5f40e19cf4b1f4f0cf7f4376854b75641036fa844a5cf36780638b919f1ebb7b5eca24fa616e4dadffe146a93b204
SHA1 hash:	19c587e757af582d81ede6524d444f338997d61f
MD5 hash:	9a12d01ae79f71cf7edc9eb54c3f58f2
humanhash:	michigan-fifteen-crazy-south
File name:	9a12d01ae79f71cf7edc9eb54c3f58f2.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	306'688 bytes
First seen:	2021-02-24 07:53:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5a2b6fae135fff3834b11ff5ad4494ae (1 x RedLineStealer)
ssdeep	6144:0ujSeuwsFFQ9gumpTuXy9kN0dclnPWfU:fjSeuwGJuOTuiuN1JeU
Threatray	1'143 similar samples on MalwareBazaar
TLSH	4664D021B791D233C59615398316C7B18E3A78316B3999C7BFD40A7A4F603E2CA3674B
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9a12d01ae79f71cf7edc9eb54c3f58f2.exe

Verdict:

Malicious activity

Analysis date:

2021-02-24 08:00:25 UTC

Tags:

installer trojan rat redline phishing stealer

Link:

https://app.any.run/tasks/ff312425-94de-4256-887c-4d7d429fc19f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/118913/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Creating a file

Sending a UDP request

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/616306

Signature

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redlinestealer

Link:

https://mwdb.cert.pl/sample/4ef2301fc3da6b681932cd7a7d32fa6a86800651976a1b9a847864a65f6234f8/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2021-02-24 06:31:09 UTC

AV detection:

17 of 29 (58.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=j3zdah6d3jvwqgjszv5h2mx2nkdiabsrs5vbxguepbskmx3cgt4a._file

Verdict:

malicious

RedLineStealer

4bb82f05f31bbc7df2350efac1d0e9e46e5b78f11b50fa6b8313066454aec918

RedLineStealer

53694d09899c9de1600743b37ab45e9dc4e3eaf329dc410e87a3b7318d943012

RedLineStealer

676593610aafb444bd3b06028cbe14c0f1bb08d621da061609436d0afbe536fb

RedLineStealer

6846c70c5392556654844ce2e05e68f248432176c88d2b92f44b1b487c6b7db3

RedLineStealer

94651db17b9e3921ba9e4484b848bfc920f6a1d451d6a2a5fe3ca9bc386d7c29

RedLineStealer

96802cd1e7ee797e260cf5379cdd8526379b6ab1c396c21f1db1dae4ca111e93

RedLineStealer

b2e0c72237dbad9cbd82ec93814b1b078779d3016d4e7d18b7bd5ff2cdeb9c68

RedLineStealer

c434d4da9f9111e836666c93d246f062baa801b1fd098ab670c537353483bad0

RedLineStealer

ec51c1a42099d2ebcb00e68608346ac14013c57f5a87713f6ab41b17c305b537

RedLineStealer

+ 1'133 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware

Link:

https://tria.ge/reports/210224-bjkv5z3hks/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Unpacked files

SH256 hash:

971eeb504efcda86539684cf0c0df9c342bfb483f32df6b5384f56c9c59f68a3

MD5 hash:

f2dce8b4c3c89a40ae60031243e678da

SHA1 hash:

76f32a4cbfc74390cdc4108a485a0660a0d683a1

Link:

https://www.unpac.me/results/615e57c2-1c51-4d04-9acc-7a23f4f0021a/

SH256 hash:

7b1a4e81d54ccea6aa1e76e4eee4e21384a9c75e4e118912673bc3092a88acd8

MD5 hash:

b2f9dfc32c89b8aaadff1a4f9b4ec4e9

SHA1 hash:

5be5de90e147db4b563fef33e58f6d1c8025f348

Link:

https://www.unpac.me/results/615e57c2-1c51-4d04-9acc-7a23f4f0021a/

SH256 hash:

2c32e826a183b745c6ac7f7907a70cb4a46f8bec1e4d59556db0ae986d9afb67

MD5 hash:

1e74cd5e12f0e55bc5893561bc0ec73d

SHA1 hash:

090a19c01f59b8b1a6a0a68ceda16842a387ee7b

Link:

https://www.unpac.me/results/615e57c2-1c51-4d04-9acc-7a23f4f0021a/

SH256 hash:

4ef2301fc3da6b681932cd7a7d32fa6a86800651976a1b9a847864a65f6234f8

MD5 hash:

9a12d01ae79f71cf7edc9eb54c3f58f2

SHA1 hash:

19c587e757af582d81ede6524d444f338997d61f

Link:

https://www.unpac.me/results/615e57c2-1c51-4d04-9acc-7a23f4f0021a/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.