MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bc03680f98a99ea21d78a4a132be678f848a7209efa0656123745fba54fae03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bc03680f98a99ea21d78a4a132be678f848a7209efa0656123745fba54fae03
SHA3-384 hash: f91491160dfd891b4c0f09053e567a080d305f3de64b61f04142e9392074c174920ed89aa232320a0ead9e41f2c1939f
SHA1 hash: cfdea74f4fd6386e42d6faddc179ff7c97e2232c
MD5 hash: b9abc27ac341388ca921c49f0c9df3b5
humanhash: yellow-mockingbird-alaska-tennis
File name:b9abc27ac341388ca921c49f0c9df3b5
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'971'136 bytes
First seen:2021-07-08 07:01:26 UTC
Last seen:2021-07-08 07:42:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:KgiRp39iwc0Jf3n+XI3zUSaIrQ/uWKY90T8pjaiJoE465gbuQa4a5Pdcj0J:KgiRXvNJPgzuWjarE46GbuLTRdc
Threatray 30 similar samples on MalwareBazaar
TLSH T1ECD548027E04CE52F08C213BD6DE510847B4E8196AE2F7277DEA33AE55563A33D0D9DA
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b9abc27ac341388ca921c49f0c9df3b5
Verdict:
Malicious activity
Analysis date:
2021-07-08 07:04:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d734b38b-f751-4234-bfc6-5313f1fe7792

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/170362/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader40.29883.31873.5090.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f79872e0-cede-4a0d-8fa0-79f425c7f4c6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/813299
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 445710 Sample: mvgOq7JxN7 Startdate: 08/07/2021 Architecture: WINDOWS Score: 60 72 Multi AV Scanner detection for submitted file 2->72 74 Machine Learning detection for sample 2->74 8 mvgOq7JxN7.exe 14 5 2->8         started        13 mvgOq7JxN7.exe 1 2->13         started        15 mvgOq7JxN7.exe 2->15         started        process3 dnsIp4 60 176.111.174.107, 49734, 80 WILWAWPL Russian Federation 8->60 62 192.162.247.237, 1377, 49774, 49790 DATACHEAP-LLC-ASRU Russian Federation 8->62 50 C:\Users\user\Desktop\chromedriver.exe, PE32 8->50 dropped 78 Uses schtasks.exe or at.exe to add and modify task schedules 8->78 17 chromedriver.exe 2 8->17         started        21 chromedriver.exe 2 8->21         started        24 chromedriver.exe 1 8->24         started        26 2 other processes 8->26 52 C:\Users\user\AppData\...\mvgOq7JxN7.exe.log, ASCII 13->52 dropped file5 signatures6 process7 dnsIp8 48 C:\Users\user\AppData\Local\...\Preferences, ASCII 17->48 dropped 76 Tries to harvest and steal browser information (history, passwords, etc) 17->76 28 chrome.exe 17->28         started        30 conhost.exe 17->30         started        58 127.0.0.1 unknown unknown 21->58 32 chrome.exe 4 61 21->32         started        35 conhost.exe 21->35         started        37 conhost.exe 24->37         started        39 conhost.exe 26->39         started        41 conhost.exe 26->41         started        file9 signatures10 process11 dnsIp12 43 chrome.exe 28->43         started        54 192.168.2.1 unknown unknown 32->54 56 239.255.255.250 unknown Reserved 32->56 46 chrome.exe 19 32->46         started        process13 dnsIp14 64 www.youtube.com 43->64 66 consent.youtube.com 43->66 68 www.youtube.com 46->68 70 consent.youtube.com 46->70
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bc03680f98a99ea21d78a4a132be678f848a7209efa0656123745fba54fae03/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-08 04:56:34 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1c0eb090ad769cdd943476e9300d57e553ad24f099408334b8c0370ee9bb7648
RedLineStealer
200b64a2d1d30811d3feae4a361bd652104ecc7ac98c7c4804f0bbf2bb47028e
RedLineStealer
47f55d901f3a0fcc649afa6e44bd4307fffd877ac92a33fde21992a93e54b27d
RedLineStealer
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
RedLineStealer
79afc9b39ba7fe7dd6ed282d39eb915bb47271d552177f62c6606b99901f9cd2
RedLineStealer
9a693191c99ec28e49e610cd89af5137fb077ad8b4d7452828dbabd055e65384
RedLineStealer
9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc
RedLineStealer
ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be
RedLineStealer
f2e2cb71a06ac2a95a02168fc3d91f160e6e07ca19c5e6d3d708a9a486dd3f92
RedLineStealer
faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939
RedLineStealer
+ 20 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware stealer
Link:
https://tria.ge/reports/210708-s45tcz1yqj/
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
8bc03680f98a99ea21d78a4a132be678f848a7209efa0656123745fba54fae03
MD5 hash:
b9abc27ac341388ca921c49f0c9df3b5
SHA1 hash:
cfdea74f4fd6386e42d6faddc179ff7c97e2232c
Link:
https://www.unpac.me/results/e59623cb-c1b0-4369-915b-a0545c0f8f03/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8bc03680f98a99ea21d78a4a132be678f848a7209efa0656123745fba54fae03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8bc03680f98a99ea21d78a4a132be678f848a7209efa0656123745fba54fae03

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1435402/
Cape
Cape
https://www.capesandbox.com/analysis/170362/

Comments


Avatar
zbet commented on 2021-07-08 07:01:28 UTC

url : hxxp://176.111.174.107/clienthost.exe