MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5cd56fddf5ebdb83ed61c0a86e0cf07915312bd1b4fc77e7b27064bf64e109df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 11
| SHA256 hash: | 5cd56fddf5ebdb83ed61c0a86e0cf07915312bd1b4fc77e7b27064bf64e109df |
|---|---|
| SHA3-384 hash: | b7fa98edb5513ab16aa1f4c7706d77d6cfda10b9e932ce05bb93f79dba0c51364ebb3cec4312e8ac0070b2555caa7844 |
| SHA1 hash: | e2d1bccca1007ddbaa5760bd82d1ba1d09c1f6b8 |
| MD5 hash: | 5803e6cb630745cf9493a14e4c859c69 |
| humanhash: | louisiana-avocado-apart-florida |
| File name: | IMG_534912.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 802'256 bytes |
| First seen: | 2021-09-29 10:35:18 UTC |
| Last seen: | 2021-09-29 15:43:39 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger) |
| ssdeep | 24576:yNFNi+hBr8UAGi2v+kMTNQ1s1Tl99QQdt7:nbNQ1s1Tri |
| Threatray | 2'235 similar samples on MalwareBazaar |
| TLSH | T18405CFCB2C6497CBFB5E01B4F6392B5801B6DC28C9DBB2DBE549B13304767A51921CCA |
| File icon (PE): |  |
| dhash icon | 0098414d91010101 (3 x RedLineStealer) |
| Reporter |  milannshrestga |
| Tags: | exe Redline RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 176.57.69.117:21596 | https://threatfox.abuse.ch/ioc/227760/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IMG_534912.exe
Verdict:
Malicious activity
Analysis date:
2021-09-29 10:31:29 UTC
Tags:
trojan rat redline
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Connects to many ports of the same IP (likely port scanning)
Detected potential unwanted application
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-09-29 10:36:06 UTC
AV detection:
16 of 26 (61.54%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'225 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:mama infostealer spyware
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine Payload
Malware Config
C2 Extraction:
176.57.69.117:21596
Unpacked files
SH256 hash:
5c1a967e4743e27b8acf1473faea8df5a31dbcf388d89a5f1b185ea4b65cb83e
MD5 hash:
ae6809ffb180bdf797aa62faf82b755e
SHA1 hash:
f4399b97273939b796f31b0c92e3bb6dc2225324
SH256 hash:
32acec02c9e359386889e4137406ab2458cf312039a508044cb5bf6c0ac88d75
MD5 hash:
3daaf593bbd5a157051d1ef305869dbc
SHA1 hash:
dbe51349e8bb218e35d5150dd1042788e6efdd67
SH256 hash:
1c6a607d95c67757585384dfe4f5143ec83f730db7b9aeec9d88be97a1861df3
MD5 hash:
93027c08ebc5d0dd99b50749f976237b
SHA1 hash:
bbece51e2906df9f81a8579856f7cf09a2d5d4d5
SH256 hash:
6a671abf66304301602b4afd0902840bc3915455cffc58d8916eaa693abe33ec
MD5 hash:
681eca96e4e7b513317178dc7065ef39
SHA1 hash:
24af82015bc57d125f1ccb759840118b2283d1dc
SH256 hash:
5cd56fddf5ebdb83ed61c0a86e0cf07915312bd1b4fc77e7b27064bf64e109df
MD5 hash:
5803e6cb630745cf9493a14e4c859c69
SHA1 hash:
e2d1bccca1007ddbaa5760bd82d1ba1d09c1f6b8
Malware family:
RedLine.A
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | pe_imphash |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | redline_stealer |
|---|---|
| Author: | jeFF0Falltrades |
| Description: | This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021) |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropping
Redline
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.