MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061
SHA3-384 hash: f2e6614c0d5ca132b8453824a16ae545968a52f9c90bc76829dc5e0b24950c2ea7b3b2707922a8e43812c071e5614b6e
SHA1 hash: 9561f6032df93c9bfeba7e0b7569205ca4c08494
MD5 hash: 6868e16886a76b94bb06530de0824102
humanhash: kitten-nebraska-blue-eleven
File name:6868e16886a76b94bb06530de0824102
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'623'360 bytes
First seen:2021-09-04 04:39:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:eHXjFFlqzTzIuKba6tmsynwzuLahORU8tk7DovbkSSlGZ7mSRWw704z8:OA7dHRQ
Threatray 884 similar samples on MalwareBazaar
TLSH T1AA268D25607BC56A4157EFE23CDC58BBE999D8B7548C323302A8C31BCB52798DD0B1B6
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6868e16886a76b94bb06530de0824102
Verdict:
Malicious activity
Analysis date:
2021-09-04 04:41:41 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/4ebda27b-c7bd-4c5e-8c8d-3df0f57ceaf4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185247/
Detection(s):
Win.Packed.Redline-9876022-1
Create hunting rule

Win.Packed.Redline-9879939-1
Create hunting rule

Win.Trojan.Generickdz-9882256-0
Create hunting rule

Win.Trojan.Generickdz-9883081-0
Create hunting rule

Win.Packed.Generickdz-9888683-0
Create hunting rule

Win.Packed.Generickdz-9889102-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
DNS request
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Connection attempt
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9eafcd2f-7ac4-420a-9f29-3c1873145d9d
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/845135
Signature
.NET source code contains very large strings
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Suspicious Svchost Process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 477562 Sample: DzA7o5djEP Startdate: 04/09/2021 Architecture: WINDOWS Score: 84 45 20.42.65.92 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->45 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected RedLine Stealer 2->57 59 .NET source code contains very large strings 2->59 61 Sigma detected: Suspicious Svchost Process 2->61 9 DzA7o5djEP.exe 1 2->9         started        signatures3 process4 signatures5 67 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->67 69 Injects a PE file into a foreign processes 9->69 12 DzA7o5djEP.exe 9->12         started        15 DzA7o5djEP.exe 9->15         started        17 DzA7o5djEP.exe 9->17         started        19 4 other processes 9->19 process6 signatures7 75 Injects a PE file into a foreign processes 12->75 21 DzA7o5djEP.exe 12->21         started        23 DzA7o5djEP.exe 15 26 12->23         started        27 DzA7o5djEP.exe 2 12->27         started        39 2 other processes 12->39 29 DzA7o5djEP.exe 15->29         started        31 DzA7o5djEP.exe 2 19->31         started        33 svchost.exe 19->33         started        35 DzA7o5djEP.exe 19->35         started        37 DzA7o5djEP.exe 19->37         started        process8 dnsIp9 41 WerFault.exe 21->41         started        47 89.41.26.185 M247GB Romania 23->47 49 104.26.13.31 CLOUDFLARENETUS United States 23->49 63 Tries to harvest and steal browser information (history, passwords, etc) 23->63 65 Tries to steal Crypto Currency Wallets 23->65 signatures10 process11 dnsIp12 51 20.189.173.20 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 41->51 53 8.8.8.8 GOOGLEUS United States 41->53 71 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 41->71 73 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 41->73 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-03 23:55:16 UTC
AV detection:
22 of 43 (51.16%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
11adb6fd4fbcb8fe68033ff2bc3b8cc45b980c573f7c58be291383d5b95d6e41
RedLineStealer
211c5e542a39bd580d591ee281d719abc67a1b9313e5eecaa904d41dc2cb9d45
RedLineStealer
2cc5f31570047becc5e77581e2f640afba8d6904c6be61105603d60d01c181d0
RedLineStealer
2db5b8398fe40439d40336311f84437499781d8659a4557b76ff7db71fa4e05e
RedLineStealer
2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324
RedLineStealer
6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9
RedLineStealer
7151dc894be6ab81d6a5ac2fb22812821fb28c2bccea1d01a54eac55ca11da2e
RedLineStealer
9453ddc4bebb87a937e3d53d38c56814907b2862496142ccdb568f48caf2d467
RedLineStealer
9ea4469f78d2953c8061672f6c7630a9728b42944e37be3e30bc6774812af88a
RedLineStealer
fff25302774366cdb466fa0e4015f9c7de93fd0192585a3cab2e2f51b635047c
RedLineStealer
+ 874 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer
Link:
https://tria.ge/reports/210904-faknxaghfl/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
RedLine
RedLine Payload
Malware Config
C2 Extraction:
89.41.26.185:49115
Unpacked files
SH256 hash:
ff570348afc335cabbff21d9143531f145ec198cae4580100f165313875cc4b6
MD5 hash:
8f45d280ff9624f734c9365ef211de25
SHA1 hash:
8443a4ae407088bb41654e864bc1e59cac9051af
Link:
https://www.unpac.me/results/456fcd3a-e172-41fc-8f1a-238d830047cf/
SH256 hash:
00825fb0f1edba41f369fad2d178cb85d800f3f69ca743e51d95903ae97e1aa7
MD5 hash:
3d09eaa16b36568072f502396cb03033
SHA1 hash:
d89b60d39ce9bddb92ae4bc7c6a41175be8a4e89
Link:
https://www.unpac.me/results/456fcd3a-e172-41fc-8f1a-238d830047cf/
SH256 hash:
85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061
MD5 hash:
6868e16886a76b94bb06530de0824102
SHA1 hash:
9561f6032df93c9bfeba7e0b7569205ca4c08494
Link:
https://www.unpac.me/results/456fcd3a-e172-41fc-8f1a-238d830047cf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 85a34b22de48d67cc0a3f669704ad180a2b230739bca0c163592aff05e4ab061

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/185247/
  
URLhaus
https://urlhaus.abuse.ch/url/1590711/

Comments


Avatar
zbet commented on 2021-09-04 04:39:27 UTC

url : hxxp://37.0.10.214/US/Tournure.exe