MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a587c3f101f95fced4c0096f4d7617aa6448f00cedba55478b439b825a491335. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	a587c3f101f95fced4c0096f4d7617aa6448f00cedba55478b439b825a491335
SHA3-384 hash:	a1e4cc288abca26e1cad9a5bbf4f392dd3a9c256bd800e40e89505f7ada81fdf8db445f267040a3382ec72a4535090b6
SHA1 hash:	28fdbfa14f46e711d2f50865a4f840347034ef1c
MD5 hash:	db09e239b077731c37488ef23c06960d
humanhash:	lima-white-muppet-two
File name:	SecuriteInfo.com.BehavesLike.Win32.Generic.dc.24713
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	292'352 bytes
First seen:	2021-01-29 21:57:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3e238b869c9d6819d41b2e2ce8b59428 (1 x RedLineStealer)
ssdeep	6144:L8VsIGxYLpx+43kcFMFfVBTaDxUzSUX/Wwje2v1nfZxahfZs:LCsIGxYr+U/FMF9BWDxmX+6v0fG
Threatray	985 similar samples on MalwareBazaar
TLSH	3E54D000B7D1D133D54658360621C2B29A3FBC76AF395AC7BB906B6A8E303D1DA36747
Reporter	SecuriteInfoCom
Tags:	RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

219

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.BehavesLike.Win32.Generic.dc.24713

Verdict:

No threats detected

Analysis date:

2021-01-29 21:58:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b7c2a150-823e-41c5-b342-35879c7a10a9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/114862/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/594425

Signature

Antivirus detection for URL or domain

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redlinestealer

Link:

https://mwdb.cert.pl/sample/a587c3f101f95fced4c0096f4d7617aa6448f00cedba55478b439b825a491335/

Threat name:

Win32.Trojan.RedLineSteal

Status:

Malicious

First seen:

2021-01-29 19:09:56 UTC

AV detection:

16 of 28 (57.14%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uwd4h4ib7fp45vgabfxu25qxvjser4am5w5fkr4lionyewsjcm2q._file

Verdict:

malicious

RedLineStealer

53694d09899c9de1600743b37ab45e9dc4e3eaf329dc410e87a3b7318d943012

RedLineStealer

7ad68e446a975c986f5b7eee1d08a588b40cb5ef301d0e689d92fc3446d7b0fb

RedLineStealer

7afefba65e72f42925ba76fae9ea98286eff7d0d01dcccd07c6117384858b6bb

RedLineStealer

9ea7a66f0c3dc13ddfc6f05d95049dd7f641053a380578a12013db9f72367f65

RedLineStealer

a33fba201470062e7411eb129e52102e9ec7150d0d4d46c877aa241d2fef826c

RedLineStealer

a3948163bc436fde2808c4c76fccc90d515f3d754fc5851f0eb1e8b40a539e2b

RedLineStealer

c7548d44039ef4712cd3161d51f4d235f7b04fac22234cfcc602a895e87d23f7

RedLineStealer

d5a592a952140b52fde783c6281f82986a3aee2f05de63fe7b6ff2d76db11670

RedLineStealer

fa123f422564ed8b12034d2fdecbafb53d8df264aa6d0fbfadaddd89c9e5ac5d

RedLineStealer

+ 975 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210129-6h636xkkta/

Behaviour

Suspicious use of AdjustPrivilegeToken

Unpacked files

SH256 hash:

0a427a6e2b8a7cce2c327bc545af9ee1c0baecc92de7065406d4dd00c29bda91

MD5 hash:

c151372405c1796c17eb7c307770f6bc

SHA1 hash:

b98f72b9fd50c6e502dc059eb7f08eed9c977114

Link:

https://www.unpac.me/results/66545823-df8f-4f85-9ad4-bc0b78c42a8d/

SH256 hash:

0c91568a905305698628b39d25c1665fe461d83306a0cf15b12cbb48fe9d750e

MD5 hash:

e677d94f0da66bcffa43db6a616d182f

SHA1 hash:

6312f4f1c9f4118e107fdc747201f7d568736d6c

Detections:

win_redline_stealer_g0

Link:

https://www.unpac.me/results/66545823-df8f-4f85-9ad4-bc0b78c42a8d/

SH256 hash:

a2dcbf93c6bec527e35d75c4521f4be08ea1baa3f2a70e5275a2a3045c88c3e5

MD5 hash:

efb8e81136dce65bc256b7bffdce2f2d

SHA1 hash:

385c4d22b6fdc7a7c1d671e1f40a6a0094c4789c

Detections:

win_redline_stealer_g0

Link:

https://www.unpac.me/results/66545823-df8f-4f85-9ad4-bc0b78c42a8d/

SH256 hash:

a587c3f101f95fced4c0096f4d7617aa6448f00cedba55478b439b825a491335

MD5 hash:

db09e239b077731c37488ef23c06960d

SHA1 hash:

28fdbfa14f46e711d2f50865a4f840347034ef1c

Link:

https://www.unpac.me/results/66545823-df8f-4f85-9ad4-bc0b78c42a8d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a587c3f101f95fced4c0096f4d7617aa6448f00cedba55478b439b825a491335

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.