MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 4


Intelligence 4 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc
SHA3-384 hash: 2fe89aba20b1d097dbe112e28f3e0d8ba61c8af06ce426cdd15c3132639d11ab9b82c6012bd6343048c31d8b8c890a76
SHA1 hash: ee10d5a43c23e1af3eea75fe097baaf9b7004de1
MD5 hash: da37656f71601d9b59eaf8a9618f4817
humanhash: princess-fifteen-pizza-jersey
File name:da37656f71601d9b59eaf8a9618f4817
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'874'368 bytes
First seen:2021-06-22 07:37:55 UTC
Last seen:2021-06-22 08:49:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 49152:FT9axbX4RGWmVmJN5QOoPklD1LWzEKMTCdybKLM0z:FT9axz4f1/KfbF
Threatray 13 similar samples on MalwareBazaar
TLSH E7D55A827E50CE02F00C5A3BD1DFA11847F8D8516AE6F7277DA9336E64163A33C499DA
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://176.111.174.107/Api/GetFile?id=needbild
Verdict:
Malicious activity
Analysis date:
2021-06-22 04:54:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c52d8d9a-4a16-455b-89b7-82f90a4fd94d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167484/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.13730.18313.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b2e889e-726c-4dc7-b42b-85ab4606f0b9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/805800
Signature
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438211 Sample: djzqkrJmZC Startdate: 22/06/2021 Architecture: WINDOWS Score: 52 26 Multi AV Scanner detection for submitted file 2->26 7 djzqkrJmZC.exe 14 3 2->7         started        11 djzqkrJmZC.exe 1 2->11         started        14 djzqkrJmZC.exe 2->14         started        16 djzqkrJmZC.exe 2->16         started        process3 dnsIp4 24 176.111.174.107, 49716, 80 WILWAWPL Russian Federation 7->24 28 Uses schtasks.exe or at.exe to add and modify task schedules 7->28 18 schtasks.exe 1 7->18         started        22 C:\Users\user\AppData\...\djzqkrJmZC.exe.log, ASCII 11->22 dropped file5 signatures6 process7 process8 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc/
Verdict:
unknown
Similar samples:
1c0eb090ad769cdd943476e9300d57e553ad24f099408334b8c0370ee9bb7648
RedLineStealer
47f55d901f3a0fcc649afa6e44bd4307fffd877ac92a33fde21992a93e54b27d
RedLineStealer
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
RedLineStealer
79afc9b39ba7fe7dd6ed282d39eb915bb47271d552177f62c6606b99901f9cd2
RedLineStealer
916df1aaac228a40f1981b539742aee6d0009fdce746f14eb646a7c70fa2cc4d
RedLineStealer
9a693191c99ec28e49e610cd89af5137fb077ad8b4d7452828dbabd055e65384
RedLineStealer
ceb9cf440fc521f09a503e90889acb7f51b4c39ce8a8c4d37dd8304fca2db4ce
RedLineStealer
d1fa4207d7c46c5f84b1c45e7b5d09aa9c99c896b0e25664bee3b13fcaabcfad
RedLineStealer
e6df8346cb599d0947c86555aeb55d98dc665448222e383f2384789e78d9e3e6
RedLineStealer
f2e2cb71a06ac2a95a02168fc3d91f160e6e07ca19c5e6d3d708a9a486dd3f92
RedLineStealer
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210622-cm79dsvzaa/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc
MD5 hash:
da37656f71601d9b59eaf8a9618f4817
SHA1 hash:
ee10d5a43c23e1af3eea75fe097baaf9b7004de1
Link:
https://www.unpac.me/results/dafac9b1-15c4-4a2a-ae38-c1faa5d5157f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/167484/

Comments