MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568
SHA3-384 hash: 1477ced8f6a1739ad890363bde20f7869ab0581596f696931e22c63544ab104ac532848e31245d85b4ea3b24cc08d1ae
SHA1 hash: 39e41fa9e87d2a6c5036ba8de39dd8ce9bd3c149
MD5 hash: 8596f6961b0df059be1a2d5317a6e4a4
humanhash: comet-high-bulldog-south
File name:56192025.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:566'272 bytes
First seen:2022-03-22 19:22:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 12288:u+RrgOX/S1UYue7EsFKaQeQS03ULaHNqrxlKIQNo3EqolY3NVzrEe+vG:ua3X/UZur/ekEaHNYK3E7oy3NVzL+e
Threatray 5'439 similar samples on MalwareBazaar
TLSH T1FEC4237AA2407D09C5CF17B4213DA684964953BE59F8F4BAF5300E438828897FF1C9FA
Reporter adm1n_usa32
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/255165/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/623a22590cd58dbd92d8de60/reports/9bb99e58-6ddc-4f25-b099-93c8416cd615/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0cbd1722-2e0d-4ec6-99f3-a5de69a75bee
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/961993
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-22 19:23:12 UTC
File Type:
PE (Exe)
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vduuf25p7dvx6tuuynnkkxsivvwvpepyni6r4apmhirktvf3svua._file
Verdict:
malicious
Similar samples:
03d7bb6de28f63752921367619ad44ca420c80352e96e8aeda734c28ca63557f
RedLineStealer
0caba418b4b1ec32a00cdd52e3f6f28b7e8de0ffec030cfd8ae661538619b72b
RedLineStealer
0d406e492d0879dc501507c610332d8db948b5d8e2df05822cf74710f4063bbd
RedLineStealer
24fe35fea083b89f0cc62ef8b9df0de29395be57b0ee1b160229d667785b6bf0
RedLineStealer
c57ec94c7fed128887694b07d817af02c2d19aac98d8d1fbd4004a8accee4ee5
RedLineStealer
f4036a8affaa6f227d3fce3a98b5b9bb752cd434f04587ea4105c58fc96404e2
RedLineStealer
+ 5'429 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer
Link:
https://tria.ge/reports/220322-x3tkysdfan/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
RedLine
RedLine Payload
Malware Config
C2 Extraction:
2.56.56.116:26011
Unpacked files
SH256 hash:
9d47269008133f4caeef6ab6363bab9edead9b3b599ead6f05754e54390731c8
MD5 hash:
4060ef39b5e1e02c86f0126f397ade1e
SHA1 hash:
549c25e7b0d3de94c9d8a246712392a8c50a5205
Link:
https://www.unpac.me/results/3c86a62c-bdf1-44b6-beff-675421cb01ec/
SH256 hash:
73f632349e4a063c51ed89ac9aa76d0a1eb5170d947650f084b16f75a5c2f686
MD5 hash:
817f2c567964ab231811a0aed56df3a4
SHA1 hash:
300cee043d26fd2cce6272f96b5458ff3823e878
Link:
https://www.unpac.me/results/3c86a62c-bdf1-44b6-beff-675421cb01ec/
SH256 hash:
a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568
MD5 hash:
8596f6961b0df059be1a2d5317a6e4a4
SHA1 hash:
39e41fa9e87d2a6c5036ba8de39dd8ce9bd3c149
Link:
https://www.unpac.me/results/3c86a62c-bdf1-44b6-beff-675421cb01ec/
Malware family:
RedLine.D
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a8e942ebaff8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/255165/

Comments