MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f593164077154a1fdd97cf86e0d320262a26eceead40fc95bb5cb97ca5674f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	7f593164077154a1fdd97cf86e0d320262a26eceead40fc95bb5cb97ca5674f1
SHA3-384 hash:	ab0e0a3ed216421aedc3a32e0e961f1b10e6e0f48101e31bd2e6ca12034c7646c4f39f1bead679a0b4a005c15df96d51
SHA1 hash:	2d2a9685cdd63b3aaf724e614760c7e31fdcafc6
MD5 hash:	cb1d4559a6ff4b4e3d62d56a4c01a319
humanhash:	virginia-whiskey-neptune-papa
File name:	cb1d4559a6ff4b4e3d62d56a4c01a319.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	680'880 bytes
First seen:	2021-12-18 11:07:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	def81bcd89fff56a072f7c109fd4635a (1 x RedLineStealer)
ssdeep	12288:GQB0hTP9k6U9+q6ptcEFxl+KkJUW0cQ0mkVkt+HllWbJYvN:GfhTPa6i+ptcEFeK250DBkGtyWG
Threatray	149 similar samples on MalwareBazaar
TLSH	T1D2E40292FE141ACFF42F8531C04696FE2570AC699AC4025F7169F63E0DB324365AFA6C
File icon (PE):
dhash icon	02f9c88e8e8ef6e2 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

154

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for analyzing tools

Searching for the window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2466/overview

Behaviour

MalwareBazaar

Verdict:

Suspicious

Threat level:

5/10

Confidence:

67%

Tags:

packed

Link:

https://www.filescan.io/uploads/61bdc1184ab5c44cbf47bee6/reports/b4034e82-e760-4b2c-bcd0-a0254116c348/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8d9ed463-00cd-4c3d-8786-70f4a42efe58

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/909500

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected unpacking (changes PE section rights)

Found malware configuration

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f593164077154a1fdd97cf86e0d320262a26eceead40fc95bb5cb97ca5674f1/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-12-17 18:04:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 43 (67.44%)

Threat level:

5/5

Verdict:

malicious

Label(s):

ryuk

RedLineStealer

46c8ac53157328105a599fd431f76664c79b597ab7686e12897b2d07043f8d2b

RedLineStealer

49e86b574240ef199ca645ea210561b237992a261da9abc88383753396a3faf3

RedLineStealer

756e7a0709dfb576279656f0b4198031859df1170005717ec6be19e6c93a4cfe

RedLineStealer

76fbd6dbf2d6ff05e54a6a0e7eb8dce158d94a468e80e1c12844e2af2e951d0f

RedLineStealer

862e13feab6936cf835fc226e167a499a09600068eefcf039239eee2db4f098b

RedLineStealer

8b4cd3466446034e108610bb5e14a9a8628d880a957c3c396c68bb920eccea90

RedLineStealer

f0b3267fa660090a9f3008f4fe70f4191d51ec5d087692a0e218a137f10dbaae

RedLineStealer

+ 139 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer

Link:

https://tria.ge/reports/211218-m8kj5affhk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of NtSetInformationThreadHideFromDebugger

RedLine

RedLine Payload

Unpacked files

SH256 hash:

992626c8c02d99f2bc866f910abe2f787554db31a622ae1f551ffca2220090af

MD5 hash:

c87510306d7c4b1fd945dcaa3f41e8ef

SHA1 hash:

f99dbaa6cdf1df867288e74e93413665068ef839

Link:

https://www.unpac.me/results/4024743f-599f-4fa0-aa17-c057ecebc38c/

SH256 hash:

7f593164077154a1fdd97cf86e0d320262a26eceead40fc95bb5cb97ca5674f1

MD5 hash:

cb1d4559a6ff4b4e3d62d56a4c01a319

SHA1 hash:

2d2a9685cdd63b3aaf724e614760c7e31fdcafc6

Link:

https://www.unpac.me/results/4024743f-599f-4fa0-aa17-c057ecebc38c/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/7f5931640771/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/7f593164077154a1fdd97cf86e0d320262a26eceead40fc95bb5cb97ca5674f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time