MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 981cb297d710406688345951378aff3a6399a46e187816718ba8c0c9a277e591. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 11
| SHA256 hash: | 981cb297d710406688345951378aff3a6399a46e187816718ba8c0c9a277e591 |
|---|---|
| SHA3-384 hash: | 7169e371903ce4ee32578654e93e061855584d8cbd4853900fb67c5a0e1cc3b9a34977c7e15614260a448e94cf78db7b |
| SHA1 hash: | 3390dc74811e7321c82e2c84238426d5dcf1387c |
| MD5 hash: | 59e705cbf8834562af81752ebe3c7d4c |
| humanhash: | equal-social-earth-minnesota |
| File name: | 59E705CBF8834562AF81752EBE3C7D4C.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 6'297'876 bytes |
| First seen: | 2021-04-03 22:05:12 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla) |
| ssdeep | 196608:RdDzo/xpQneHFepsa8Zty0dEjDJLZ9odBpk5:RdDk/mU8sXZbKpjodBpE |
| Threatray | 525 similar samples on MalwareBazaar |
| TLSH | 26563341FBB998F3C8330A3555316716657E79300F30884F63C20E79DA78BE2666BE66 |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| http://185.251.25.225:6677/IRemotePanel | https://threatfox.abuse.ch/ioc/6687/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
287
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
59E705CBF8834562AF81752EBE3C7D4C.exe
Verdict:
Malicious activity
Analysis date:
2021-04-03 22:06:24 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Sending a custom TCP request
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Sending a UDP request
DNS request
Launching a process
Creating a file
Sending an HTTP POST request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Running batch commands
Forced system process termination
Unauthorized injection to a recently created process
Stealing user critical data
Launching a tool to kill processes
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RedLine
Status:
Malicious
First seen:
2021-03-31 05:15:34 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 515 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline infostealer
Behaviour
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
d82356965428c7542083ec1e71cd82b09ec883bccf91db931c438e2b4aeca4ec
MD5 hash:
cdc0f37014a4c760c964ee05e85e7426
SHA1 hash:
acf3434780b9643bdc2c8550c5822695578bec14
SH256 hash:
31081b9f1937f5966cdeff6eb747e0595fbda15130af7a02b49c0e2ad9d543da
MD5 hash:
98ba9b0f4d8f9dce6c08c94d850a3ef0
SHA1 hash:
47a9a0d8270f3b021752bfe90f7f62186fb6d4e0
SH256 hash:
a56de4bafd5468ff132ff8414f8331666537ceaaed1c271bcbff09ed9406468a
MD5 hash:
c404f12f5634f954a49df698f953c738
SHA1 hash:
1b9ae02ec930786d44b2389db6237ce2a4558bdb
SH256 hash:
f634584ce4141c19234b7ca768420f3198d7beaafdbd56473075cb2434a62c42
MD5 hash:
3bc9842a1e1bdc67dcb4812ae89e143b
SHA1 hash:
17b49a7a978a301298bca0ecb66697449bc254f9
SH256 hash:
981cb297d710406688345951378aff3a6399a46e187816718ba8c0c9a277e591
MD5 hash:
59e705cbf8834562af81752ebe3c7d4c
SHA1 hash:
3390dc74811e7321c82e2c84238426d5dcf1387c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.