MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9ea7a66f0c3dc13ddfc6f05d95049dd7f641053a380578a12013db9f72367f65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 8
| SHA256 hash: | 9ea7a66f0c3dc13ddfc6f05d95049dd7f641053a380578a12013db9f72367f65 |
|---|---|
| SHA3-384 hash: | f29a65bd3ea9a99ba5ce6f93c26bcdbb71fbcfc56e1f2f8babcbb81d14faa3cde7694abd3ac6618c8e816aa5accfac47 |
| SHA1 hash: | 712ca2ebaa7d9bc9bbe18f7843954cfb0d22b08e |
| MD5 hash: | 72131adb0e2315281aae445db11e09a2 |
| humanhash: | eleven-kansas-juliet-cold |
| File name: | 72131adb0e2315281aae445db11e09a2.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 351'232 bytes |
| First seen: | 2020-11-01 18:44:09 UTC |
| Last seen: | 2020-11-01 20:50:27 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 22c87ff9d53c8eae0251c1eaef3e8242 (3 x ZLoader, 2 x RedLineStealer) |
| ssdeep | 3072:Ci8VE2ZEIO95NbjA6J85TnOg2r++sCVYueyX5I4R3CDNCRpuj62R+aBYYpQoEiqW:mKPdbdJtbCZCq4X5VduNyUjkTYyk |
| Threatray | 406 similar samples on MalwareBazaar |
| TLSH | 0774DF117691C433C65244313521E3B16E39BCA26D7489C77BC8EF6B6E322D1EBA634E |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
DNS request
Connection attempt
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Downloader.Dofoil
Status:
Malicious
First seen:
2020-11-01 17:46:21 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
3/5
Detection(s):
Malicious file
Verdict:
suspicious
Similar samples:
+ 396 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
ce28a1e20fdd8d3f576e41ab97f8c382e7fb03ca2cdc6bf3c79f95df00b04a8b
MD5 hash:
14f2752bce6aa1b070da87fe9e681896
SHA1 hash:
8575caecdd8f3e79b6f6c7d07321695f5c21ae17
Detections:
win_redline_stealer_g0
SH256 hash:
d679faa43389367badab249429e9278e8bdd946c031475d79d8c9dca12fffe0d
MD5 hash:
55101c0ae3daf55ed3ea260e45742b56
SHA1 hash:
e62cb7c58883ce83007b566f0e8966ac750602ea
SH256 hash:
5ad780d0ee7ea62640d307fbb094d70451f3cc01f082ba9b46163c37bb9ea349
MD5 hash:
21944bf2039c76cddb62a54678c313e8
SHA1 hash:
f3760022ddd5db91c8bf4f7d0e096109e9e8f066
Detections:
win_redline_stealer_g0
SH256 hash:
9ea7a66f0c3dc13ddfc6f05d95049dd7f641053a380578a12013db9f72367f65
MD5 hash:
72131adb0e2315281aae445db11e09a2
SHA1 hash:
712ca2ebaa7d9bc9bbe18f7843954cfb0d22b08e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.