MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5273e1a49241f0d712f9eda40183beddfa6c31fd260a59b25bffcd8c0a22158c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 12
| SHA256 hash: | 5273e1a49241f0d712f9eda40183beddfa6c31fd260a59b25bffcd8c0a22158c |
|---|---|
| SHA3-384 hash: | 272849ae462bc4ff510d6b268da1fc6fab39f5ab58a1cda1d108334fc64d37b6afea6b9c686300d714258c5ee39ecc5f |
| SHA1 hash: | 488d4bb19da2850be564f9aafa324448d06344d7 |
| MD5 hash: | 511abbe3413d879eff2006e32f250ecf |
| humanhash: | mockingbird-fifteen-nitrogen-glucose |
| File name: | Pallet Mould MMS Request Order-061522.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 509'952 bytes |
| First seen: | 2022-06-15 06:17:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'633 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:7EV5LZuJBOnuKI4hY9jf6Xq2nc0rDccec3cyg:qZu3Op69jf6nncifecx |
| Threatray | 1'600 similar samples on MalwareBazaar |
| TLSH | T1ACB4D06023BC4319D17AEBFEF031542407F97627312AF3AD4B5578DA2AD27828533A67 |
| TrID | 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 103.153.79.195:24688 | https://threatfox.abuse.ch/ioc/705716/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
Pallet Mould MMS Request Order-061522.exe
Verdict:
Malicious activity
Analysis date:
2022-06-15 06:26:44 UTC
Tags:
trojan rat redline stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.FormBook
Status:
Malicious
First seen:
2022-06-15 00:57:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 1'590 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:firstfile discovery infostealer spyware stealer
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
103.153.79.195:24688
Unpacked files
SH256 hash:
5e95b92999dc337f367d2c8e91e68daadbcdfc537d2d11fa2612ce68a58e8d04
MD5 hash:
e3df2dd40f0ce5dcd593a52653983ca4
SHA1 hash:
d7d895a35867dc41c8a03ab5ec3aa4e38e1a08a3
SH256 hash:
a88f3036b04a091890717f20625e06ecea0ed3f39d927d130ff926673eef655b
MD5 hash:
e108df8e9984413636396f443d28ef70
SHA1 hash:
bdf3e51ca53d961a3ec6cea148ea707a9492cbb5
SH256 hash:
1699f740bdcdb3778ca69d53dc9c5fa58edfe1a610cbaa935c40ac73f0c0bad2
MD5 hash:
c50bf647703bcc0dff7ac82bec360565
SHA1 hash:
50ed555e1b6db733c1536931958c33e77c5817d6
SH256 hash:
5c6f0374f2c3478ac6e7c8629caf19be1dcfc18b7fae8b41c5cdcc962b30a011
MD5 hash:
933540a953da3d0072a00a86e8d07fc9
SHA1 hash:
13f2b76177c17501486fad10a2ec1563b25b05c8
SH256 hash:
5273e1a49241f0d712f9eda40183beddfa6c31fd260a59b25bffcd8c0a22158c
MD5 hash:
511abbe3413d879eff2006e32f250ecf
SHA1 hash:
488d4bb19da2850be564f9aafa324448d06344d7
Malware family:
RedLine.A
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | exploit_any_poppopret |
|---|---|
| Author: | Jeff White [karttoon@gmail.com] @noottrak |
| Description: | Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries. |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.