MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e3e15aaf05f995fde696fd7e54c21c3af5331623a3dd7f8279060f72b18518f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e3e15aaf05f995fde696fd7e54c21c3af5331623a3dd7f8279060f72b18518f
SHA3-384 hash: 01471a5e6b18a939d1bd52ec77a9dbf64d4f96344f164d81357a03aa44181d325aca609361465fb2221ed15d463a4a9a
SHA1 hash: e7e2034e361605d45b082b1eb838091f5855458a
MD5 hash: 13a3cf4d0ca3e11c15b6faabd2762ff0
humanhash: massachusetts-fillet-may-sodium
File name:13a3cf4d0ca3e11c15b6faabd2762ff0.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:21'723 bytes
First seen:2021-05-29 07:16:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 192:MWWKPVR76TChp0zeNHGXGVPaKX/0r4em27/KXOIWnSXxUa+XR3Pqc6t:UaR76TM0kPRXcr4eViFgB1
Threatray 27 similar samples on MalwareBazaar
TLSH 30A21A14BBD945B9DDBF8B7419B322228270C9852526DF4F6D88089DDB17B608D83FE8
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
13a3cf4d0ca3e11c15b6faabd2762ff0.exe
Verdict:
No threats detected
Analysis date:
2021-05-29 07:19:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bd94a7e4-ff89-4786-9005-e33f67a20fb6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/163140/
Detection(s):
Win.Packed.Clipbanker-9802325-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
ClipBanker
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6eac7f42-857a-41b0-8f9a-7b84f757675d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/794202
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e3e15aaf05f995fde696fd7e54c21c3af5331623a3dd7f8279060f72b18518f/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-05-29 01:27:00 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1f6c43e2bd2c2d8a9c8b603488301fdf6b1c074a88e9b48e4b6a9daeab0b1718
RedLineStealer
2886de9d76ef4a0531d223adddb017ca6f0ac5f1d69c16c7595b0ac9051d5438
RedLineStealer
3c3bee00c300584717e1c307e690d05ab1c6c98428d83ca0d4285fe24a9e1015
RedLineStealer
3c47f8bdb6cb223b1b28ad2401962949c90f1780028be03d775b7d4322aef6f0
RedLineStealer
586871a8aa5c08be02631a432daa373d9e40fdd0dd53b80f0210f53b41dbbfb3
RedLineStealer
5dbe7d927fbad788711eb319a3450f00b1f8618b6e2bbe83d2db30276f8e8ff2
RedLineStealer
ad8554c3f5d4811f6a4868a84054f8a55606243ec783fe47e42409ed431e875e
RedLineStealer
c22d25107e48962b162c935a712240c0a4486b38891855f0e53d5eb972406782
RedLineStealer
f368e01fbba37ee10ab9a92e0aba1f68f7b92f7bc67a4670fcfb0d93f87be451
RedLineStealer
fa41a78a3b24f0d18bacd18b56d9c33481e7b976ccae540a82daf6bbed348433
RedLineStealer
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210529-kjzn53ajl2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/6e3e15aaf05f995fde696fd7e54c21c3af5331623a3dd7f8279060f72b18518f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 6e3e15aaf05f995fde696fd7e54c21c3af5331623a3dd7f8279060f72b18518f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/163140/
  
URLhaus
https://urlhaus.abuse.ch/url/1296318/
  
Delivery method
Distributed via web download

Comments