MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f9c881d55ee853803be5f29c249ea49c498e65312c9eb95739727084d19644e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments 1

SHA256 hash:	6f9c881d55ee853803be5f29c249ea49c498e65312c9eb95739727084d19644e
SHA3-384 hash:	88a36e1507756bc22080fb15355a5e86880defd4587b581477822a7a57d0ee8666ad8db4b3bdbea7194350d2c2ef4886
SHA1 hash:	cd4d18e57708ea162166e571f8b9ef04d121fbf1
MD5 hash:	1f9fff35c7d3e5d0f6c2553ee3a22cd2
humanhash:	hydrogen-twenty-four-quebec
File name:	1f9fff35c7d3e5d0f6c2553ee3a22cd2
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	6'075'392 bytes
First seen:	2021-11-19 22:12:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f054065b5627efa75960a094c4ceb3ad (5 x RedLineStealer)
ssdeep	98304:/0C4LIhDUiaAGwiwGj2STa4mYamaB0Cy8JbrqYdNpsCXkXV/UrsYkKIaOlfA2dR:9bhD4Nw5Gj23FnTBpJbrjc/LYDsz
TLSH	T16756237B216821C5C1E4CC36CA3BFE9A72F5627E8F417CF8A5C96CC625125F4A242E53
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

118

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1f9fff35c7d3e5d0f6c2553ee3a22cd2

Verdict:

Malicious activity

Analysis date:

2021-11-19 22:16:53 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/fea1bec2-4beb-4225-87f2-b98992ee29f7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.38063318.2698.4594.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6198213543e8f62b669b02d8/reports/0da186fe-d8fc-4993-96ba-9ef6da441866/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/02e8129a-2b59-4bef-b7e4-761c2abc70f7

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/892960

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

Detected VMProtect packer

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f9c881d55ee853803be5f29c249ea49c498e65312c9eb95739727084d19644e/

Threat name:

Win32.Spyware.Sabsik

Status:

Malicious

First seen:

2021-11-18 23:58:07 UTC

AV detection:

23 of 28 (82.14%)

Threat level:

2/5

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

vmprotect

Link:

https://tria.ge/reports/211119-14h3dsegf7/

Behaviour

Suspicious behavior: EnumeratesProcesses

VMProtect packed file

Unpacked files

SH256 hash:

7e023d8cac98ccee2a8998805981ac4672970829187242df11841b62d7196e64

MD5 hash:

85989bddd5a2fed6c743f98f03180cdb

SHA1 hash:

4ded61d888c8903d3ba78669ff9e054ed7d4f017

Link:

https://www.unpac.me/results/2f118edb-731e-407e-a0c1-717836ee6692/

SH256 hash:

f363e1a1be2304bcc491d78d66a474c152de20b0140e18830f14dc0fb7de3f2c

MD5 hash:

7329039b8b6f71524aa05a4b8fa5aefd

SHA1 hash:

79544324d225fe67e9f29f3bdd6d1ec88ad530e1

Link:

https://www.unpac.me/results/2f118edb-731e-407e-a0c1-717836ee6692/

SH256 hash:

6f9c881d55ee853803be5f29c249ea49c498e65312c9eb95739727084d19644e

MD5 hash:

1f9fff35c7d3e5d0f6c2553ee3a22cd2

SHA1 hash:

cd4d18e57708ea162166e571f8b9ef04d121fbf1

Link:

https://www.unpac.me/results/2f118edb-731e-407e-a0c1-717836ee6692/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/6f9c881d55ee853803be5f29c249ea49c498e65312c9eb95739727084d19644e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.