MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments

SHA256 hash:	6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9
SHA3-384 hash:	896572d57a84ee405078f10a9172ad29d622477cdf35781dd456482d89e317ee8ff2dea9622f53cf9a6814da3b022a28
SHA1 hash:	93afab714d86aa97cc706a0726cf7bcec36cdf07
MD5 hash:	99e98c0d5122c38e1fc3885092111fff
humanhash:	rugby-november-bulldog-timing
File name:	99e98c0d5122c38e1fc3885092111fff.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	645'504 bytes
First seen:	2021-08-28 16:20:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:ZClXHzC7b94xVEXTVp4D6Owv3cEShbRh+MPjCa7jhxTGUZWds/C8vifHyd+:EdoHP4DRx7V+
Threatray	683 similar samples on MalwareBazaar
TLSH	T166D4DB28657FC019C4E7EEB12DDCA4BAD99A94E3640D763311B4A33B8B11B84DE0F479
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

157

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

99e98c0d5122c38e1fc3885092111fff.exe

Verdict:

Malicious activity

Analysis date:

2021-08-28 16:21:28 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/82a29bfa-d40b-4a21-8680-9f473072a218

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/183066/

Detection(s):

Win.Packed.Redline-9876022-1

Win.Packed.Generickdz-9879553-0

Win.Packed.Redline-9879939-1

Win.Trojan.Generickdz-9882256-0

Win.Trojan.Generickdz-9883081-0

Win.Packed.Generickdz-9888683-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Unauthorized injection to a recently created process

Creating a window

Connection attempt

Sending a custom TCP request

Sending a UDP request

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ab2ec670-6da4-4e9e-aeb1-b109b62e71b4

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/840780

Signature

.NET source code contains very large strings

Connects to many ports of the same IP (likely port scanning)

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-08-28 16:21:09 UTC

AV detection:

19 of 46 (41.30%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=n7qqa4d7atw5l3nli2vrjc5jaltatjay23rj7y653wqkrjn3f7mq._file

Verdict:

malicious

RedLineStealer

1e7f2339065e8a6909eea27f090499a1af6427d1563ceac0cd25c916c637d29d

RedLineStealer

4101bd379660a169d50442c9921d6fb0329620efbc5a163856c2f5e5f41e601c

RedLineStealer

56e45f6af87cf8505b1d88360f14bf00bca7be5108db4d4283fab4605fca2482

RedLineStealer

ba15a8b7d1ecc6348ee4806b0903afdf5917a595a909ce529e85cacd197c6e77

RedLineStealer

bda2b27d917dc919d2df7f2768a5d20f4f554e6f0eeb687f5ac45b53aecbb2f3

RedLineStealer

c62b515006bc08b9c7e66fedb39b4751a20fe34f19a322d7e40447c70937a6d0

RedLineStealer

cfcb21c8c129c8c2c525ecfac8bd883260eda6038e3991210765e582007451dd

RedLineStealer

+ 673 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:29.08 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210828-ztk6nt65pa/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

95.181.152.47:15089

Unpacked files

SH256 hash:

f345bd9d965a1342f6269d98b8563c862ce15d8b08a211c47efe2b0804b7f572

MD5 hash:

cabf893ae2a9e31874508567cbea19f0

SHA1 hash:

837c4d6860575ad99565e5bf645e54f6a177f74f

Link:

https://www.unpac.me/results/9c18ff2d-4bea-4ba4-89c0-a5020e946082/

SH256 hash:

6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9

MD5 hash:

99e98c0d5122c38e1fc3885092111fff

SHA1 hash:

93afab714d86aa97cc706a0726cf7bcec36cdf07

Link:

https://www.unpac.me/results/9c18ff2d-4bea-4ba4-89c0-a5020e946082/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	redline_stealer Create hunting rule
Author:	jeFF0Falltrades
Description:	This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)