MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 673a4571b3bec07ef953c5aaf3b940b4ca622c8919608c8235f9347e6dd512e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 7
| SHA256 hash: | 673a4571b3bec07ef953c5aaf3b940b4ca622c8919608c8235f9347e6dd512e5 |
|---|---|
| SHA3-384 hash: | 7cea4ff3dc99812a5a8cf222ccd8780ca6b88c03219fab4bdbd8f7b7fa89e104330406803dec7fddc5eaafd8dcbb88f6 |
| SHA1 hash: | bbc560af02bc1a00bb5fbb45d02f3eca73ccbed0 |
| MD5 hash: | 6400394906f6433d4eae8791f18aa638 |
| humanhash: | ten-lithium-lion-sixteen |
| File name: | Order.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 1'646'592 bytes |
| First seen: | 2021-07-16 12:48:08 UTC |
| Last seen: | 2021-07-16 13:50:41 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:wSlWFvGjHCo7pvnNKa8hvcBlHBEMbacT7y3TEiopRdWk:wSlW8vn4JChEMWcWTlEB |
| Threatray | 42 similar samples on MalwareBazaar |
| TLSH | T15B75E63E6AA42A27B777D2644681C015F8BC91DB3A395DD742C7698C350E8027EE7F2C |
| Reporter |  James_inthe_box |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order.exe
Verdict:
Malicious activity
Analysis date:
2021-07-16 12:54:52 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Gorgon Group
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spre
Score:
68 / 100
Signature
.NET source code contains very large strings
Infects executable files (exe, dll, sys, html)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-07-16 08:48:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
15 of 28 (53.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 32 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops autorun.inf file
Suspicious use of SetThreadContext
Drops startup file
Unpacked files
SH256 hash:
41456504a4b7e16d08f4cee7c5c44fee5c349afe8d1175726b35f4c69fabc56c
MD5 hash:
48aa759c23d80a1683152d64c5a1d31c
SHA1 hash:
ef8b6472a1dd13ef891990d9fa958cc06bea860a
SH256 hash:
d5269341b232c436c3d74e6523709a601c47f12abf46e3f9d9ebcde91217f205
MD5 hash:
38109d0bb969803311cce443ab4cbd56
SHA1 hash:
ceb786148cf609bbd611c82f5fe82055d2ec6b02
SH256 hash:
82a4065578bf324c5a382d4e43510bfe37dc2d4accaa25792aecea77c7387714
MD5 hash:
ecff0ff8f308ad9a7ab4e8d8c6632f1f
SHA1 hash:
b2149cd8ad0767e9ee467d85f7f5d97494ecb07a
SH256 hash:
eeeee599d6db687a7f5a7f7eca915bd3bb9ae05c079873d7cc9bf7a2f6b1ae47
MD5 hash:
cb4b37011c2b94dfb0d1e451e0f4d01f
SHA1 hash:
98805b3664f082638cf5dfbe0c64c64c012cda54
SH256 hash:
673a4571b3bec07ef953c5aaf3b940b4ca622c8919608c8235f9347e6dd512e5
MD5 hash:
6400394906f6433d4eae8791f18aa638
SHA1 hash:
bbc560af02bc1a00bb5fbb45d02f3eca73ccbed0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.