MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6738043e241a436a0fbc227fda2bd4ae10647c565c9c15e2cf03228270dbd0bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6738043e241a436a0fbc227fda2bd4ae10647c565c9c15e2cf03228270dbd0bc
SHA3-384 hash: 88a9d5a39b4a3a4d1100282e086473953ab7472138949b4f9579b81c37cf9d20b62b7d2799ab8d9dcc24fae7eadb464d
SHA1 hash: 71d2467f172f2d075683da97832b06043ea1c04b
MD5 hash: e31fdd0dc461701ee2a12b6e4714fe5c
humanhash: king-ink-jersey-papa
File name:e31fdd0dc461701ee2a12b6e4714fe5c.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'194'496 bytes
First seen:2022-11-11 19:10:25 UTC
Last seen:2022-11-11 20:52:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:DITPlQNHfp7tdquUE1RB7E4QgVKD8J+63oT:DITPmN/pX7RBo4QgVKD0+wo
Threatray 24'687 similar samples on MalwareBazaar
TLSH T1F545290925B5C433F44907F45224F9EC253CEC0B6E88924FA8B2FD576E79AA7F498D12
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13097/50/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.47.61.37:38369

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
SOA22663773883993.doc
Verdict:
Malicious activity
Analysis date:
2022-11-11 18:40:13 UTC
Tags:
exploit cve-2017-11882 loader trojan rat redline agenttesla stealer
Link:
https://app.any.run/tasks/6b291378-d4a0-4b62-bd2c-340523debeda

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332579/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.44597.5378.19374.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Packed2.44597.17946.9552.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/636e9e4782dd9f2e2653a128/reports/8597aa20-401f-40a4-8ea0-fe0b5384b19b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a6e996f-9b93-4420-8644-10f967b618a9
Result
Threat name:
AgentTesla, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1111486
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses known network protocols on non-standard ports
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 744181 Sample: N9tsFM0HyJ.exe Startdate: 11/11/2022 Architecture: WINDOWS Score: 100 35 Malicious sample detected (through community Yara rule) 2->35 37 Yara detected RedLine Stealer 2->37 39 Yara detected AgentTesla 2->39 41 9 other signatures 2->41 8 N9tsFM0HyJ.exe 3 2->8         started        process3 file4 23 C:\Users\user\AppData\...239tsFM0HyJ.exe.log, Unknown 8->23 dropped 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->51 53 May check the online IP address of the machine 8->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->55 12 N9tsFM0HyJ.exe 15 4 8->12         started        signatures5 process6 dnsIp7 31 api.ipify.org.herokudns.com 3.232.242.170, 443, 49685 AMAZON-AESUS United States 12->31 33 api.ipify.org 12->33 25 C:\Users\user\AppData\Roaming\...\build.exe, PE32 12->25 dropped 57 Tries to steal Mail credentials (via file / registry access) 12->57 59 Tries to harvest and steal browser information (history, passwords, etc) 12->59 61 Installs a global keyboard hook 12->61 17 build.exe 14 32 12->17         started        file8 signatures9 process10 dnsIp11 27 193.47.61.37, 38369, 49686, 49688 TH-AS-APTianhaiInfoTechCN Germany 17->27 29 api.ip.sb 17->29 43 Antivirus detection for dropped file 17->43 45 Multi AV Scanner detection for dropped file 17->45 47 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->47 49 4 other signatures 17->49 21 conhost.exe 17->21         started        signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6738043e241a436a0fbc227fda2bd4ae10647c565c9c15e2cf03228270dbd0bc/
Threat name:
ByteCode-MSIL.Trojan.RedLineSteal
Create hunting rule
Status:
Malicious
First seen:
2022-11-11 19:11:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m44aipredjbwud54ej75uk6uvyigi7cwlsoblywpamrie4g32c6a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0818b9a336a3ed6868ff92baf070532650f993541d9a0459a27c397f4ffc98d9
RedLineStealer
2f1fa3784cd1f226cbcbbccbbc0c4bc067584429de021e2b4f7bcdac6cbeb05a
RedLineStealer
4073df659d58e6b8619746e412f0649a8fc4a67da64d27e4a1dcadf797cfcc70
RedLineStealer
554abc5a7bd4db2017ff789017e2a440fd8b9e580346146dce336b20b0c42c5c
RedLineStealer
791d28363cac830f755941fbd116d6c30cbd38f7c88f4b5f7f318feea4836fdd
RedLineStealer
902d6e472c33f0b6deff39548253e09dc3c0df227cec877b16d9c3a646c48508
RedLineStealer
a058e4db6871ecf56adf444c908980dbfb1a6eddc2cb2eae86d86c6df6111c30
RedLineStealer
ceeaf351408125592c58eb70508f0387f293210a0f8ce14cbbda70fd6ef2254c
RedLineStealer
+ 24'677 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:redline botnet:cheat collection discovery infostealer keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221111-xvxmmsda2y/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
RedLine
RedLine payload
Malware Config
C2 Extraction:
193.47.61.37:38369
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/dcb7865c-2e38-40e3-8d3d-edada388f39c
Unpacked files
SH256 hash:
8a9edb0b6d1f5db7dcf8079194d89d561059456a2a681ed95de95094130a3ff6
MD5 hash:
4b6aac9d61df79e471d4b8159e0204f3
SHA1 hash:
e50348945186ef18eab2d41428e11bb120195d0e
Link:
https://www.unpac.me/results/85fdf2ba-3d42-489c-b2ef-b38aac8a389a/
SH256 hash:
fc2c4fbd2af9e48b879ebe7c1f1f6418843c004da44810663e0fe8c29735fb80
MD5 hash:
8986bdef7afb6ab4e57169d72c204d3d
SHA1 hash:
da0b5053b563ad792ac63059150b5c57f861e6d1
Link:
https://www.unpac.me/results/85fdf2ba-3d42-489c-b2ef-b38aac8a389a/
SH256 hash:
cfc16a2dbb933b1b85807d48966e9301b9fc34f4c44e7357713ca88b54bf4ab4
MD5 hash:
aabd0bdc81026ade6c57383f21d5c227
SHA1 hash:
4b26936bb8c03be6d7963184215a5ab594ecb765
Link:
https://www.unpac.me/results/85fdf2ba-3d42-489c-b2ef-b38aac8a389a/
SH256 hash:
199c3edfd20aa763267acd0ab9b236484e9d09689f6545bad1daec5ab68d2540
MD5 hash:
83fc044860e8f73fc94ac2e8f226813b
SHA1 hash:
340cfe1b79b24dbe4156e82a18999390f2e0fb76
Link:
https://www.unpac.me/results/85fdf2ba-3d42-489c-b2ef-b38aac8a389a/
SH256 hash:
ab19f28c700d64814b0c55df868c30dfb94e0a1f9fb6f7bca05bac6eb78a4e52
MD5 hash:
1f2a6c02dcf9aa00a28a5039fb5b8ce0
SHA1 hash:
1ef480867d39b98368af7586a8e6ba38c0c3893a
Link:
https://www.unpac.me/results/85fdf2ba-3d42-489c-b2ef-b38aac8a389a/
SH256 hash:
6738043e241a436a0fbc227fda2bd4ae10647c565c9c15e2cf03228270dbd0bc
MD5 hash:
e31fdd0dc461701ee2a12b6e4714fe5c
SHA1 hash:
71d2467f172f2d075683da97832b06043ea1c04b
Link:
https://www.unpac.me/results/85fdf2ba-3d42-489c-b2ef-b38aac8a389a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6738043e241a436a0fbc227fda2bd4ae10647c565c9c15e2cf03228270dbd0bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 6738043e241a436a0fbc227fda2bd4ae10647c565c9c15e2cf03228270dbd0bc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2408128/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/332579/

Comments