MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 910ac144ccbde84d9a6946123312c35d8c2291a62a9efc142edd2c59cb8fab15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	910ac144ccbde84d9a6946123312c35d8c2291a62a9efc142edd2c59cb8fab15
SHA3-384 hash:	d76c4f0714255010cbbd3f689ce9870f88cbc60e78e5863300fc7fd46af70a2efaceadacefc646240770d6d69b6e582c
SHA1 hash:	e37c8e5de78d60714fd8f101d31d460fdc57a2e1
MD5 hash:	e84ae34cc7c120450d9f858fa2ffb536
humanhash:	skylark-blue-sierra-london
File name:	e84ae34cc7c120450d9f858fa2ffb536.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	20'992 bytes
First seen:	2021-02-18 15:33:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	384:/sbKtZgD2wWSBn3slZWjurl+RZuWq0HBRAdcXiP0:/sbKtE2w+lUMl+RUWXBC0
Threatray	21 similar samples on MalwareBazaar
TLSH	EF923B21BBE8D73ED5AA4FB6587199814271F38A4502DF1ED8C8119A7F039408F733A6
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

150

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/117812/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.61597.32276.27731.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Launching a process

Creating a file

Sending a UDP request

Creating a window

Using the Windows Management Instrumentation requests

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Connection attempt to an infection source

Stealing user critical data

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/611754

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Binary contains a suspicious time stamp

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/910ac144ccbde84d9a6946123312c35d8c2291a62a9efc142edd2c59cb8fab15/

Threat name:

ByteCode-MSIL.Downloader.Seraph

Status:

Malicious

First seen:

2021-02-18 12:57:03 UTC

AV detection:

19 of 46 (41.30%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sefmcrgmxxue3gtjiyjdgewdlwgcfengfkppyfbo3uwfts4pvmkq._file

Verdict:

suspicious

RedLineStealer

20510b85596724711f8fb4c7111055086f6e44845206038fa7b7c4bcfebf2265

RedLineStealer

60a4e3f1d748ace4e6b82ba68fce30bf35b0f2e6bbbb9aa1e8d690c7406b744d

RedLineStealer

79d5b3a1a8b602ecb6ffb87e5c42acdaa4403e81cb3dcf859e573392c2350dc0

RedLineStealer

82bd69c7b58c486211c511d719f44cf734ddc90d062431ef366d77f32557b5e6

RedLineStealer

8ad59828630ebb9691c466a275558e87680d02c62b423c9210596c75de2d2c95

RedLineStealer

c120fd3e62a0ecd299625f3fbf622fb8a56b534828b6788fe766f1bc36ac7a68

RedLineStealer

e401a949ac7801d662b4f05acb3dc55e604de12632f032c6efecbc607a848ba9

RedLineStealer

ef9a0bce5286a538e8a405e41aa15b2fe89bb40323558ee88ac14e4f7e81c818

RedLineStealer

f78e324f60652665b5c350396eaa6f31b973bd73bb0396d7cb5eb24eb551737d

RedLineStealer

+ 11 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer

Link:

https://tria.ge/reports/210218-8e41tva96n/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

RedLine

RedLine Payload

Unpacked files

SH256 hash:

910ac144ccbde84d9a6946123312c35d8c2291a62a9efc142edd2c59cb8fab15

MD5 hash:

e84ae34cc7c120450d9f858fa2ffb536

SHA1 hash:

e37c8e5de78d60714fd8f101d31d460fdc57a2e1

Link:

https://www.unpac.me/results/2f252914-9a7a-497f-8a8c-fd7d9f9313da/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/910ac144ccbde84d9a6946123312c35d8c2291a62a9efc142edd2c59cb8fab15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time