MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a085e4af6a5b200d9cfe44c811c7f40e7f275122c5ae62b204835bbd6d7b1e05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	a085e4af6a5b200d9cfe44c811c7f40e7f275122c5ae62b204835bbd6d7b1e05
SHA3-384 hash:	b6082e515467c729717130610b9340bae0e3d5e1372e56e093f55a3a7efd0398f43d1a99e0ad3b78c999cb4d1fad47bb
SHA1 hash:	51618f2f1ce6a964ac3a351eeeffde37f331a707
MD5 hash:	398f0215f3333dbd815bc0bfc28f34c1
humanhash:	king-seven-mockingbird-juliet
File name:	Cheat.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	3'708'720 bytes
First seen:	2022-02-08 07:32:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	41304e4befbbd8a63ad6ec59f252160b (56 x RedLineStealer, 4 x RaccoonStealer, 2 x CoinMiner)
ssdeep	98304:PskD1AvUdlQdvdlj09kFOu8v0XKEXyzNLxMzs:kksvfjs9u8vgKRl9
Threatray	1'199 similar samples on MalwareBazaar
TLSH	T19706336D4719E9A4C7C4337017A3E6B5F3E33293E6B5E641A49C8BCEB304DE5A31A805
Reporter	adm1n_usa32
Tags:	exe Redline RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Cheat.exe

Verdict:

Malicious activity

Analysis date:

2022-02-08 07:31:29 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/dde5da68-a7f1-43aa-8a5d-088d7d241b4d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/237766/

Detection(s):

PUA.Win.Packer.Asprotect-3

Win.Packed.Fragtor-9937217-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Launching the default Windows debugger (dwwin.exe)

DNS request

Searching for the window

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Sending a custom TCP request

Creating a file

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/62021cb04077c8b9a0203200/reports/40c8eb45-7b78-4fd0-969f-42a8ffca3507/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/522954e0-8f05-499e-aad8-8ca701e042f0

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/936003

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a085e4af6a5b200d9cfe44c811c7f40e7f275122c5ae62b204835bbd6d7b1e05/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2022-02-08 07:33:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 43 (60.47%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ucc6jl3klmqa3hh6itebdr7ubz7soujcywxgfmqeqnn323l3dycq._file

Verdict:

malicious

RedLineStealer

15df73dad867d9fc37d282336230f4e1fe4397288f02a06c05a28d084908f0b6

RedLineStealer

2c7e8a9b546f7c133469fabcfc200e5ab79da84ffa180fda9e088bc5476af860

RedLineStealer

447a360df02395eed4be5ed1552c279f80c2c12cb10fc80759992caf70e75605

RedLineStealer

48027757a1a094a10889267946a724be5cdb3e2e121198e9287fd2dcf6e27f57

RedLineStealer

5017901794c5147a06624b1f03292d87b0dfd6662569ce397fad912369c583b1

RedLineStealer

512a285e71ca64c29b40cb0d68517521b460766bbe0a2233cf66959e227c37d8

RedLineStealer

56c6e786a980422a6dc322c54dee750a936f4f143d268053d392a4486c10b5d3

RedLineStealer

640b631dc5019c2aa40361b62eaad8c5a55860e903fb1751f6e1560e97d00451

RedLineStealer

efbfaa4b6724b098aa4f0a844f1d4650d330026188a206fdaa266fda181a1e63

RedLineStealer

+ 1'189 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/220208-jdll6aegd9/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Drops file in Windows directory

Suspicious use of NtCreateProcessExOtherParentProcess

Unpacked files

SH256 hash:

b7fd3d642575969a5f6cb1e9a7c3d776f7846336a93bd0fc3e971dff2b78c6c3

MD5 hash:

2fe4d462585c781f5ba046b286d35239

SHA1 hash:

d2394217d57be5a811ef42e7c396eb3275ee4476

Link:

https://www.unpac.me/results/3ba87bf8-02b0-4419-8f3e-679ea30641d6/

SH256 hash:

a085e4af6a5b200d9cfe44c811c7f40e7f275122c5ae62b204835bbd6d7b1e05

MD5 hash:

398f0215f3333dbd815bc0bfc28f34c1

SHA1 hash:

51618f2f1ce6a964ac3a351eeeffde37f331a707

Link:

https://www.unpac.me/results/3ba87bf8-02b0-4419-8f3e-679ea30641d6/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/