MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10
SHA3-384 hash:	5c6c1540eecf09a9172bcfc7061b7bc6cf2c05c7ed489e23a72f1a25eb4abbd34eb4b06060a7dd25cfa73c3266e9e4e1
SHA1 hash:	422259fd61260aca4657de916d7d8b3db9db1218
MD5 hash:	19c602ba2b9193963399a7ee234d5001
humanhash:	batman-quebec-coffee-november
File name:	19c602ba2b9193963399a7ee234d5001.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	395'776 bytes
First seen:	2021-10-02 07:17:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	21506be3202517bb1e8cd3e1062868ad (5 x RedLineStealer, 5 x RaccoonStealer, 2 x Formbook)
ssdeep	6144:l7rZLB3fYDm4Nm/3JdYPkUtZqc4p+S8jnp8+GqJL6POOhxxdeTr/ekI:tZdMmTnYrD34p+SUJL6zzxd6L
Threatray	7'133 similar samples on MalwareBazaar
TLSH	T1CF84CF0832A2CFF2D67502F1AB06C7E04A7D7D6C5D2A764F3798761EBE3D3919A12205
File icon (PE):
dhash icon	4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

19c602ba2b9193963399a7ee234d5001.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-02 07:19:03 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4b9f5819-74d5-492b-8ca0-4b2b1e7bf5ef

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/194146/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen3.3246.22601.20092.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/97056c3d-dfda-491d-9c7f-bc811918b3e6

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/863103

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10/

Threat name:

ByteCode-MSIL.Backdoor.Convagent

Status:

Malicious

First seen:

2021-10-02 05:34:01 UTC

AV detection:

24 of 45 (53.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=j72dlt65t2pi5k7awaskddpnvnci5s4sjwyo3ja3xz5svmiezyia._file

Verdict:

malicious

RedLineStealer

1f94c8c257ec14cab280e89a7ebd1a3b2befd02eb9388e2d0cdb083632f3a666

RedLineStealer

360099a2671501102cf321e820d7d80f997effcea91ff43c7251ba2313af5c94

RedLineStealer

3f8b10edee659fb77181d28955a822548a0f3e95dc14a35170bcf47f126dde6a

RedLineStealer

53b1759f1d5658a208b6f51a516f511cf56cc847b3f7d589393cea2ed456a8ea

RedLineStealer

5b48e69769529215e35e1417c1c1cabeb0cc3a8c456af5769b54d222c9d1a05e

RedLineStealer

5f037c930f37e4307f4582f99aab214301591f3b87e9a0500cc3c7130fa209b1

RedLineStealer

8ded5414bc42c9a09ea3619a31a449729dff87952537f36907288585179da31b

RedLineStealer

dd7cafe1ec74547073de35dbb26140cd504814e02f551e2ff45dd255df0418ee

RedLineStealer

e108e203e4b31615afcf88bddfed51dd499f6a1628fa93b7d9072400259ecc5b

RedLineStealer

+ 7'123 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:pub infostealer

Link:

https://tria.ge/reports/211002-h4ytqsdhe8/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

7de1f501c6f4edfbb3e61dda5d445b4482235420e19cd3e193ae3be26d374367

MD5 hash:

858ebd87027f4c3adcb5e2c59ec5161c

SHA1 hash:

f758ceef9690fb7430c910fcffd71c0cdb456834

Link:

https://www.unpac.me/results/b4f39f42-ba44-4769-a982-e21af2b17ff8/

SH256 hash:

541526a7b80a64b50c770517545d25c0515a146c3ddc5600a65d91cfdaf5e3a0

MD5 hash:

d964fece1f6eade1b3b0ab1ca479d7e1

SHA1 hash:

cf6948b22255272da7d81e38a936ee90b95c17ee

Link:

https://www.unpac.me/results/b4f39f42-ba44-4769-a982-e21af2b17ff8/

SH256 hash:

4e04bba712969aa15782d796bd66233e30de2ceb2fd6f23f8ec88b64b4857636

MD5 hash:

26e6a498e6fdb35574c6a6e51e0b7d1c

SHA1 hash:

394bd2b1362a1fe2fb96cc69971fa08c43bcbf14

Link:

https://www.unpac.me/results/b4f39f42-ba44-4769-a982-e21af2b17ff8/

SH256 hash:

4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10

MD5 hash:

19c602ba2b9193963399a7ee234d5001

SHA1 hash:

422259fd61260aca4657de916d7d8b3db9db1218

Link:

https://www.unpac.me/results/b4f39f42-ba44-4769-a982-e21af2b17ff8/

Malware family:

RedLine.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/4ff435cfdd9e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.