MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72963b69c0f6b2194c28b95a56d8aef0fe2461f7387f97199f0b349628e86496. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72963b69c0f6b2194c28b95a56d8aef0fe2461f7387f97199f0b349628e86496
SHA3-384 hash: 31c4da1e1f93860a73b3437831df590f685321f7c48ac6fba3b4d1c0118cd1d893dfa1db0f6a5effdd554e119850439c
SHA1 hash: 6d5d0f25100890336d3dd4b93bfcbd69243ef31c
MD5 hash: 6249dda38e476945dc0b5694ce956c40
humanhash: comet-grey-maryland-alpha
File name:1D40F773FC7559E478572A30D1CDB0436E1FD792
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:311'432 bytes
First seen:2021-10-12 22:10:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61a760e7d283c156cc4104eecedb12bb (5 x RedLineStealer, 1 x CoinMiner.XMRig)
ssdeep 6144:HI7xv3KqsQ8AFsvX984Ky7atTdUvMwQCS16cy9Lpub15:Hsx98tm+kwQDXy9obP
Threatray 7 similar samples on MalwareBazaar
TLSH T180641231CEB159FBD9846A71DC1DDB38881F2DBA97A4F2D439907947580336D8AA10CB
File icon (PE):PE icon
dhash icon 38fcdedffbfefc78 (2 x RedLineStealer, 1 x CoinMiner.XMRig)
Reporter Anonymous
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1D40F773FC7559E478572A30D1CDB0436E1FD792
Verdict:
Malicious activity
Analysis date:
2021-10-12 22:08:57 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/84d58797-9868-454d-8697-0594ddefd3d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197044/
Detection(s):
Win.Trojan.Gandcrab-6689993-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Launching a service
Creating a window
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Using the Windows Management Instrumentation requests
Reading critical registry keys
Query of malicious DNS domain
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
gandcrab overlay packed
Link:
https://www.filescan.io/uploads/616607f81c2d58ba7403c567/reports/29324721-324d-4911-8b5a-aeb8d3e4aac6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/18d43db9-cbc8-43ed-bd66-d309851038b4
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/869100
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Machine Learning detection for sample
PE file has a writeable .text section
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/72963b69c0f6b2194c28b95a56d8aef0fe2461f7387f97199f0b349628e86496/
Threat name:
Win32.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-10-12 22:12:45 UTC
AV detection:
23 of 44 (52.27%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Similar samples:
0b976213f5961eb9720219d2624463ec6acc8947004710c7e9885746e2e27234
RedLineStealer
1410147075fb5c4cd1d7d67569d7b3a62554d21c87514714a550a079ebe93301
RedLineStealer
64ed3e89fb128c7331af068406ef798501349167efda88d24b7cdde2dcd7b489
RedLineStealer
b41455dfe45bf98bd2f1acec07d7a0df02a3c83e1fdecfb403df3984ab794761
RedLineStealer
dca7dfca9a2d0c5dd7677e1491a2fd5c0e0c2f82026b7590f691561cb30cbd58
RedLineStealer
fad39635cac516fe112c996e7fe9fa7d09d4074f349f515626a758dbd38fd336
RedLineStealer
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/211012-13x5xsdagj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
72963b69c0f6b2194c28b95a56d8aef0fe2461f7387f97199f0b349628e86496
MD5 hash:
6249dda38e476945dc0b5694ce956c40
SHA1 hash:
6d5d0f25100890336d3dd4b93bfcbd69243ef31c
Link:
https://www.unpac.me/results/f8793af5-e75e-4c02-b90c-7054139abf06/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/72963b69c0f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gandcrab
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/72963b69c0f6b2194c28b95a56d8aef0fe2461f7387f97199f0b349628e86496

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/197044/

Comments