MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fed06d9e18cee0339342b1f05330bf6bca2be92d7de29f568fc16167cdb09ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fed06d9e18cee0339342b1f05330bf6bca2be92d7de29f568fc16167cdb09ef
SHA3-384 hash: dd3b6ef974b8df521e77d7ff043765c96b6171d10130a93c43fca8617c7ec1b74dfb5f0d2404aa444af54e1f7907aaa4
SHA1 hash: 3d8f6a59f8435a4b04f0717bb4750212fefaa6d8
MD5 hash: 61bad51c37a5452935ff1da39f03754f
humanhash: victor-west-uniform-stream
File name:61bad51c37a5452935ff1da39f03754f
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:385'024 bytes
First seen:2021-12-08 00:37:36 UTC
Last seen:2021-12-08 04:25:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:KPBpy/bMlvXzUqo3rGeYtiYzqxZNTSgdh1wIHe5V/qy:oAML9o3CeYtiooNSgdh1fEVd
Threatray 3'319 similar samples on MalwareBazaar
TLSH T10484E140A7F40A17F2FA077889F212455B74F9A6A906D3AE0EC0B07E0C977D44F64BA3
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
61bad51c37a5452935ff1da39f03754f
Verdict:
No threats detected
Analysis date:
2021-12-08 00:41:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/560f8b38-d379-48a7-9ca9-7a9e28a2c6a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/212315/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.23292.12652.15143.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Сreating synchronization primitives
Sending a custom TCP request
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed redline
Link:
https://www.filescan.io/uploads/61affe6d4d8e6f3a5e18353e/reports/f6dd7f4c-01e1-4e50-8eca-9bca904f5887/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c124a57b-11e5-40d5-930b-4177599e546e
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/903559
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Microsoft Workflow Compiler
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 536037 Sample: I3A74AHGtM Startdate: 08/12/2021 Architecture: WINDOWS Score: 84 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected RedLine Stealer 2->27 29 3 other signatures 2->29 6 I3A74AHGtM.exe 3 2->6         started        process3 file4 19 C:\Users\user\AppData\...\I3A74AHGtM.exe.log, ASCII 6->19 dropped 31 Writes to foreign memory regions 6->31 33 Injects a PE file into a foreign processes 6->33 10 RegSvcs.exe 2 6->10         started        13 Microsoft.Workflow.Compiler.exe 6->13         started        15 AddInUtil.exe 6->15         started        17 SMSvcHost.exe 6->17         started        signatures5 process6 dnsIp7 21 45.67.228.227, 58696 SERVERIUS-ASNL Moldova Republic of 10->21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fed06d9e18cee0339342b1f05330bf6bca2be92d7de29f568fc16167cdb09ef/
Threat name:
ByteCode-MSIL.Worm.SpyBot
Create hunting rule
Status:
Malicious
First seen:
2021-12-07 07:20:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l7wqnwpbrtxagojufmpqkmyl626kfpus27pct5li7qlbm7g3bhxq._file
Verdict:
malicious
Similar samples:
0dd171d325f25de39f62bfef5fba30d0f2551079fade53987f535ce9894eddd8
RedLineStealer
1f32c94f55bcefb65e8f03108025a8439afa500ae6a5bcba56e762c168e96e67
RedLineStealer
2f475f00571b3b739cff8c945ec60c76506e99048550b0e7a5632a1c9cbcccb5
RedLineStealer
4970975b3596048497e4cd865a66e68b017afddc392ce8de6d1b071846908295
RedLineStealer
56b5c8eac3ee5f3d8da478b56ef2262f37f877d6a626596dbb6e1a9aec217cc5
RedLineStealer
60daa3e62cd9bf9377fd9a69ca78dfac4a84b0026e38912b690891be85d90edc
RedLineStealer
b64ebec172e3e15e585f7ef145828490dcd99ac0f70cbd17e6bf849265e89ec9
RedLineStealer
+ 3'309 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:happyny infostealer
Link:
https://tria.ge/reports/211208-ay3lqseaar/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.67.228.227:58696
Unpacked files
SH256 hash:
5fed06d9e18cee0339342b1f05330bf6bca2be92d7de29f568fc16167cdb09ef
MD5 hash:
61bad51c37a5452935ff1da39f03754f
SHA1 hash:
3d8f6a59f8435a4b04f0717bb4750212fefaa6d8
Link:
https://www.unpac.me/results/f6b0b5f9-1e79-467d-86ae-e73fbab7078a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5fed06d9e18c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/5fed06d9e18cee0339342b1f05330bf6bca2be92d7de29f568fc16167cdb09ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 5fed06d9e18cee0339342b1f05330bf6bca2be92d7de29f568fc16167cdb09ef

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1864424/
Cape
Cape
https://www.capesandbox.com/analysis/212315/

Comments


Avatar
zbet commented on 2021-12-08 00:37:37 UTC

url : hxxp://212.193.30.29/USA/123_300us.exe