MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a511d0605a1ea81db6df8c401b77db2ee5dbdcc8c19849580581a3a7b3a2cd94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a511d0605a1ea81db6df8c401b77db2ee5dbdcc8c19849580581a3a7b3a2cd94
SHA3-384 hash: 81976db21860d17d95905bb3230b9ebd1306a0965ffdfff25992b88b5524bb9c534b1d828f7e3258008a00521371f45b
SHA1 hash: a5b55fedb6e746db7bea4a84dc1a53db9f1a1cda
MD5 hash: 36841c10797b63c848f336cebdf8a8c7
humanhash: william-eighteen-illinois-six
File name:36841c10797b63c848f336cebdf8a8c7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'228'160 bytes
First seen:2021-10-10 11:52:22 UTC
Last seen:2021-10-10 13:02:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:dUhk9BRVvdWaiicHkZf8hu/QplVxK32K8QE6:dv9BRVvU+EnpnxK3
Threatray 7'126 similar samples on MalwareBazaar
TLSH T173E5CF053D0FCA52CCAD09FCA83BD6E453567D40ACADE0B3F56A73AB1A30747D666248
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
615710_IDM-Crack-639-B.zip
Verdict:
Malicious activity
Analysis date:
2021-10-09 21:02:24 UTC
Tags:
trojan loader evasion rat redline stealer opendir vidar raccoon
Link:
https://app.any.run/tasks/13d4e750-c8dd-4743-b7c5-dc53e159683d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196386/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.20514.21669.23060.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6162d4241c2d58ba74ff5f17/reports/459b083a-e839-456d-8a24-2cd23ef3e0ce/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a511d0605a1ea81db6df8c401b77db2ee5dbdcc8c19849580581a3a7b3a2cd94/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-10-10 11:53:13 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0cca2cf75954208aae60a90301ad47085d2631ada3f2c493ff5a8c043e2d7728
RedLineStealer
26475ed3848e105b527811e024a8d2cebfe254225898cbef04e2507a0c2f2a25
RedLineStealer
32bbafcfeb06498d54fd75c87947404055dc95c7baefb381fe49de79d4a47065
RedLineStealer
3d9c989fec01c48d91044ab58bf7af9a8d425609ec4dd8633216c106f8c880c7
RedLineStealer
6a498d84dd0cba5d8e272cbc5cb10382e7fd0da648a345e92c26414ceb5d3dc8
RedLineStealer
cb28fed6c60c5e3d6dfc93e5d48164348e75efacffd7d06b9a96c6996fdd9846
RedLineStealer
cfa609ebc5780ab5ea678154e60e6e483076f82c74ec1129a3653b1c35173736
RedLineStealer
e78f30b6a760350796129bd3e25b5cb88ba9bd31084878014642a25abb1c5ab0
RedLineStealer
edd5a3dc519a5feacea84473ade885844e72b8165a93a91871928330bde659e7
RedLineStealer
fb4bab16f67ebc7ce75c5b34b34d05508963bc31a76f692ba63ddc9869c69595
RedLineStealer
+ 7'116 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/211010-n2b5vafhaq/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a511d0605a1e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.94
Link:
https://yomi.yoroi.company/submissions/a511d0605a1ea81db6df8c401b77db2ee5dbdcc8c19849580581a3a7b3a2cd94

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe a511d0605a1ea81db6df8c401b77db2ee5dbdcc8c19849580581a3a7b3a2cd94

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1642816/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196386/

Comments