MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60a4e3f1d748ace4e6b82ba68fce30bf35b0f2e6bbbb9aa1e8d690c7406b744d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	60a4e3f1d748ace4e6b82ba68fce30bf35b0f2e6bbbb9aa1e8d690c7406b744d
SHA3-384 hash:	ae6ca58c8f7488639f54dd5e7ead230b60e1e3cec9c2cbcf78850d2162eeb5cb7dcc12f315bb8e3a72a18cf5ca2c3291
SHA1 hash:	5556eee0f033dfcd035049e514fa16c465bddfa7
MD5 hash:	cbdd85315022d3c984a95c7c89c62167
humanhash:	alabama-butter-oxygen-lithium
File name:	cbdd85315022d3c984a95c7c89c62167.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	20'992 bytes
First seen:	2021-02-15 07:49:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	384:tsytz8SSsvnEBwvSdfPfgh1iQTcte0aCTUAiVtdHYpS6+HkMdjAdcXHzrA:tsytz8mcBwaBWAteXHbrA
Threatray	11 similar samples on MalwareBazaar
TLSH	C8922A25BBEC933AC5EB4B7948B398619571E3874503E71F49C8919EAB03B804E73397
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

cbdd85315022d3c984a95c7c89c62167.exe

Verdict:

Malicious activity

Analysis date:

2021-02-15 07:50:31 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/16b1db73-e28b-4a3d-8473-7fbe25a5d340

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/117136/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.61597.26025.16346.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Launching a process

Creating a file

Sending a UDP request

Using the Windows Management Instrumentation requests

Creating a window

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Connection attempt to an infection source

Stealing user critical data

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/607830

Signature

Allocates memory in foreign processes

Binary contains a suspicious time stamp

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/60a4e3f1d748ace4e6b82ba68fce30bf35b0f2e6bbbb9aa1e8d690c7406b744d/

Threat name:

ByteCode-MSIL.Trojan.Razy

Status:

Malicious

First seen:

2021-02-14 22:44:32 UTC

AV detection:

11 of 29 (37.93%)

Threat level:

5/5

Verdict:

suspicious

RedLineStealer

20510b85596724711f8fb4c7111055086f6e44845206038fa7b7c4bcfebf2265

RedLineStealer

3f15edcb2b91d9c839392479ddb8a4053e80a3ec9c158c59b1d71691ba42ee13

RedLineStealer

7f2da313a75add2d2762a6f8ef8ca2828fb96661ab726b8aaad79ae5f89577c9

RedLineStealer

887084bcfd243d9c685a80c8b94ff04b56936b6a282988a2488463ba70e7d054

RedLineStealer

ab726a7fa6bca9c0d71686c601534a575530461a42160f7c74e3eae694f64012

RedLineStealer

caee9387d7ef6216014c68f4acb557c2eaee0b6e9dd79141288eb1d9d06bf30c

RedLineStealer

d8b71994b025ebed63397309543305e2fb8f463025eb94b020abce565d346329

RedLineStealer

e401a949ac7801d662b4f05acb3dc55e604de12632f032c6efecbc607a848ba9

RedLineStealer

e8234089e3729bbb6cbf5cf5deddad37b3dbe90180bc307ac8105f5f240a5b82

RedLineStealer

+ 1 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer

Link:

https://tria.ge/reports/210215-368fjg9mej/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

RedLine

RedLine Payload

Unpacked files

SH256 hash:

60a4e3f1d748ace4e6b82ba68fce30bf35b0f2e6bbbb9aa1e8d690c7406b744d

MD5 hash:

cbdd85315022d3c984a95c7c89c62167

SHA1 hash:

5556eee0f033dfcd035049e514fa16c465bddfa7

Link:

https://www.unpac.me/results/0efdada9-705e-4331-a232-49ec56c5bfa5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/60a4e3f1d748ace4e6b82ba68fce30bf35b0f2e6bbbb9aa1e8d690c7406b744d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time