MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd
SHA3-384 hash: e824101cfa8cc924cfd83398b599177c781588a78a738fd331f55226889cfb1bf1a060cdff6474b7b29bcabae1291c1b
SHA1 hash: 1c1973c377ef3bdcaf4ebb7020aad5dc1413c43f
MD5 hash: 4ea58f64f2e07a252c21d18d1156c96b
humanhash: don-sixteen-east-muppet
File name:4ea58f64f2e07a252c21d18d1156c96b
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:636'928 bytes
First seen:2021-08-30 23:05:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:LGTbR1sssqOssqOFXmzaC7b94xVpiPQ2vDYdXNsaNXuxDehxTeUZWv5Vu9z6RFiG:aTbR1sssqOssqOEz/6QvD
Threatray 824 similar samples on MalwareBazaar
TLSH T19CD4EC2865BFC019C0E7EEB12DDCA4BAD99A94E3A40D76331174633B8B11B84DE4F479
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4ea58f64f2e07a252c21d18d1156c96b
Verdict:
Malicious activity
Analysis date:
2021-08-30 23:08:16 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/8bbd049d-1c94-4ae7-ad49-199b10273c69

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/183914/
Detection(s):
Win.Packed.Redline-9876022-1
Create hunting rule

Win.Packed.Redline-9879939-1
Create hunting rule

Win.Trojan.Generickdz-9882256-0
Create hunting rule

Win.Trojan.Generickdz-9883081-0
Create hunting rule

Win.Packed.Generickdz-9888683-0
Create hunting rule

Win.Packed.Generickdz-9889102-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Connection attempt
Sending a custom TCP request
Sending a UDP request
DNS request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c342cbe-a2d3-49ec-975b-097132e434cc
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/842064
Signature
.NET source code contains very large strings
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 474494 Sample: hOH2LPCqDq Startdate: 31/08/2021 Architecture: WINDOWS Score: 64 24 clientconfig.passport.net 2->24 26 api.ip.sb 2->26 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected RedLine Stealer 2->34 36 .NET source code contains very large strings 2->36 8 hOH2LPCqDq.exe 1 2->8         started        signatures3 process4 signatures5 38 Injects a PE file into a foreign processes 8->38 11 hOH2LPCqDq.exe 15 4 8->11         started        14 hOH2LPCqDq.exe 8->14         started        16 hOH2LPCqDq.exe 8->16         started        18 18 other processes 8->18 process6 dnsIp7 28 45.14.49.184, 25321, 49723, 49730 ITGLOBAL-NL Netherlands 11->28 30 api.ip.sb 11->30 20 WerFault.exe 23 11 14->20         started        22 WerFault.exe 16->22         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-30 18:38:18 UTC
AV detection:
24 of 46 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3l5xuc4tcbcbheq7md7qizw2tdxkm2f5gi2ulqca5gtlvj57x6q._file
Verdict:
malicious
Similar samples:
1af55649a731abb95d71e2e49693a7bcf87270eb4f8712b747f7e04a0a2a3031
RedLineStealer
2cc5f31570047becc5e77581e2f640afba8d6904c6be61105603d60d01c181d0
RedLineStealer
39441b31111e865ef9d0aa72bee372afb6926cae4e2480fe246eee578a3dd51d
RedLineStealer
6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9
RedLineStealer
935099f2160f2dd5fec6a63ea02c81d80c0b2cbf712b0e48b386a81078a627dd
RedLineStealer
ba15a8b7d1ecc6348ee4806b0903afdf5917a595a909ce529e85cacd197c6e77
RedLineStealer
bda2b27d917dc919d2df7f2768a5d20f4f554e6f0eeb687f5ac45b53aecbb2f3
RedLineStealer
f99b757416d428b28579a9a2554049908c88abf1a2f547fda30fe00e617f071f
RedLineStealer
fff25302774366cdb466fa0e4015f9c7de93fd0192585a3cab2e2f51b635047c
RedLineStealer
+ 814 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:norman discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210830-lyfwf8qpys/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.14.49.184:25321
Unpacked files
SH256 hash:
f3da4c2affad1f1bf2bcf25be3360ce7604f39f0439f296f818f6700727fdc62
MD5 hash:
0d84f6cbadeede72175d69f275156058
SHA1 hash:
20225d60dd97e5be8fb6e459bdc43382ddb2a422
Link:
https://www.unpac.me/results/418ec1b3-cfd5-472e-aec3-14311dfb8bca/
SH256 hash:
8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd
MD5 hash:
4ea58f64f2e07a252c21d18d1156c96b
SHA1 hash:
1c1973c377ef3bdcaf4ebb7020aad5dc1413c43f
Link:
https://www.unpac.me/results/418ec1b3-cfd5-472e-aec3-14311dfb8bca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1578917/
Cape
Cape
https://www.capesandbox.com/analysis/183914/

Comments


Avatar
zbet commented on 2021-08-30 23:05:26 UTC

url : hxxp://37.0.10.214/WW/Garland.exe