MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5be6e545412f81d95e255012405473ab48b5d4251131e4fb0b2156f8e3798266. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 9
| SHA256 hash: | 5be6e545412f81d95e255012405473ab48b5d4251131e4fb0b2156f8e3798266 |
|---|---|
| SHA3-384 hash: | d881f8e3f59269ffb53d3f3c73d2c7c1023e9cf98582e3d5fd13c23d87e57da7a57d7afa80371df790df9a1543450a15 |
| SHA1 hash: | 1abda866c20e29255363b2ad1291938754cc3911 |
| MD5 hash: | a153fbdc2659186ce4147a2149a0cd85 |
| humanhash: | comet-william-diet-wyoming |
| File name: | a153fbdc2659186ce4147a2149a0cd85.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 373'248 bytes |
| First seen: | 2021-06-14 00:30:34 UTC |
| Last seen: | 2021-06-14 01:40:46 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:Eq0f9MZp3/6tyske1mpzFCquONxKD1PdSYGUfWEedFbbEL9lKFA0ekqYNLb:Equ9+p3/6B8HuO/o1rGnFfIOW0NqYN |
| TLSH | A084F12C2FFC0916D5BBAFFD54E42612C77AB1333A53E749095121A60A23FC5C9816BB |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 2.56.213.5:64543 | https://threatfox.abuse.ch/ioc/103808/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a153fbdc2659186ce4147a2149a0cd85.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-14 00:36:30 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large strings
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-06-11 17:52:33 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
5/5
Detection(s):
Malicious file
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline discovery infostealer spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Unpacked files
SH256 hash:
1367929dc7a677e3882c3ab2782d75c23476f19e50b02f65b33778714960c759
MD5 hash:
0520b5f12c3905cfbb2b8bc8fba06cc2
SHA1 hash:
a81a7b157a3879536c07a95b6f147cd55c299274
SH256 hash:
5921eae60fa88bfe84759d00f2ef989daf96f1e0cd719ec83b54c53acefdbf2b
MD5 hash:
3554bc5296a4ea6a4b3977236025501b
SHA1 hash:
6b5b6545c73eb7f26a36292b14d28662fa321306
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
SH256 hash:
5be6e545412f81d95e255012405473ab48b5d4251131e4fb0b2156f8e3798266
MD5 hash:
a153fbdc2659186ce4147a2149a0cd85
SHA1 hash:
1abda866c20e29255363b2ad1291938754cc3911
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.