MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f7b0b388fb8638d90451559c8b9acd0c94d729e1579d93093c5f7d5651675cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f7b0b388fb8638d90451559c8b9acd0c94d729e1579d93093c5f7d5651675cb
SHA3-384 hash: 9dc1cf9c647961a60a960a34b84598e2b1fdba062f8b4187e1d95ab58f91ea728f2fa679a7ad9b08cdc44aff23e4e6cc
SHA1 hash: a256aba588f97778c69c41f93d73e3e045a314c1
MD5 hash: 36fb5ba2ff9166a3337d819504fe2526
humanhash: autumn-mountain-victor-river
File name:36fb5ba2ff9166a3337d819504fe2526
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:8'061'952 bytes
First seen:2021-09-02 00:27:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:Navem/BZdBvrE8iCPpgx1ST9gL/PdQ9xyFtFr2haqErLnArSdVLm7g9zqglDev:
Threatray 47 similar samples on MalwareBazaar
TLSH T13286462869BB501D6573FF913EDCA9EEDDDF66632509686B1085030B8A12F80EF4393D
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup_x86_x64_install.exe
Verdict:
Malicious activity
Analysis date:
2021-08-30 09:06:50 UTC
Tags:
trojan evasion opendir loader rat redline stealer raccoon vidar
Link:
https://app.any.run/tasks/8882ba1e-9c63-47ee-a8ce-8aef0760007c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184608/
Detection(s):
Win.Packed.Redline-9876022-1
Create hunting rule

Win.Packed.Redline-9879939-1
Create hunting rule

Win.Trojan.Generickdz-9882256-0
Create hunting rule

Win.Trojan.Generickdz-9883081-0
Create hunting rule

Win.Packed.Generickdz-9888683-0
Create hunting rule

Win.Packed.Generickdz-9889102-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b287aecd-d504-4804-bcfa-f67865cc0c18
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/843710
Signature
.NET source code contains very large strings
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f7b0b388fb8638d90451559c8b9acd0c94d729e1579d93093c5f7d5651675cb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-30 16:00:54 UTC
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2cc5f31570047becc5e77581e2f640afba8d6904c6be61105603d60d01c181d0
RedLineStealer
39441b31111e865ef9d0aa72bee372afb6926cae4e2480fe246eee578a3dd51d
RedLineStealer
4d463ef06d78819067503412ef6f554eb2a5e968e332530ede9d093e5a21866b
RedLineStealer
6fe100707f04edd5edab46ab148ba902e609a418d6e29fe3dddda0a8a5bb2fd9
RedLineStealer
8ed7dbd05c9882209c90fb07f82336d4c7753345e991aa2e02074d35d53dfdfd
RedLineStealer
935099f2160f2dd5fec6a63ea02c81d80c0b2cbf712b0e48b386a81078a627dd
RedLineStealer
c85c4e2e3f1e39dadeef2a82c4faafe45fb5098236b62d9c821b91c915b66ebb
RedLineStealer
e4243a2f49e119acbf11700c1c9f52b01414cbc2e31a60da0492ef984a0c73f9
RedLineStealer
f99b757416d428b28579a9a2554049908c88abf1a2f547fda30fe00e617f071f
RedLineStealer
fff25302774366cdb466fa0e4015f9c7de93fd0192585a3cab2e2f51b635047c
RedLineStealer
+ 37 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210902-kx7ms7cmtx/
Unpacked files
SH256 hash:
9f7b0b388fb8638d90451559c8b9acd0c94d729e1579d93093c5f7d5651675cb
MD5 hash:
36fb5ba2ff9166a3337d819504fe2526
SHA1 hash:
a256aba588f97778c69c41f93d73e3e045a314c1
Link:
https://www.unpac.me/results/3bcd1467-72b7-42c3-ae0b-da48075ba1b2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/9f7b0b388fb8638d90451559c8b9acd0c94d729e1579d93093c5f7d5651675cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 9f7b0b388fb8638d90451559c8b9acd0c94d729e1579d93093c5f7d5651675cb

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1584649/
Cape
Cape
https://www.capesandbox.com/analysis/184608/

Comments


Avatar
zbet commented on 2021-09-02 00:27:53 UTC

url : hxxps://km.popmonster.ru/1305533303.exe