MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b517436f70d5299ff5decc0c61ea633cd19204f90b2e048a598b24909c434254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b517436f70d5299ff5decc0c61ea633cd19204f90b2e048a598b24909c434254
SHA3-384 hash: 8cc5df972d4c1e98272b58fcda2721026f94584f4d91c4218d952500fb3bdc23a4eb6afd130521493491e92bfcfab501
SHA1 hash: b1053686702d07100cf84063f2050b8cd0e033a7
MD5 hash: 38aa19be7c9df9e5956c6b2770133347
humanhash: nitrogen-enemy-beryllium-pip
File name:32189386.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:570'368 bytes
First seen:2022-03-21 06:22:26 UTC
Last seen:2022-03-21 08:06:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 12288:DlQUv7wQE3NXoJQo4OW/QS03ULaHNqrxlKIQNojTC+K5DyoxjFrkG:ey7wQyo4HkEaHNYK35+K5Dyox5YG
Threatray 5'366 similar samples on MalwareBazaar
TLSH T1F4C4235AB2D2AF9EC18EEF345E20DD8BD3894C1590B0B152D21B5B5CA9348CB7F4936C
Reporter adm1n_usa32
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/253246/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/623819c8b94fb38cb4c08250/reports/4af7508a-55ab-4e26-99c3-32967262bce6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2e118873-135d-4c95-9299-a4c0917aee06
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/961053
Signature
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b517436f70d5299ff5decc0c61ea633cd19204f90b2e048a598b24909c434254/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-16 15:08:47 UTC
File Type:
PE (Exe)
AV detection:
28 of 41 (68.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wulug33q2uuz75o6zqggd2tdhtizebhzbmxajcszrmsjbhcdijka._file
Verdict:
malicious
Similar samples:
0d8ed2c3adb568ac0630b572ac4c79f1023a7266c1bb2c4e23f7dc7467781d86
RedLineStealer
18d3c86e8cf3eef27c596430279fade1c4c46b3ed4e59de2912ef2c803e13e32
RedLineStealer
267ca80ba7f91e7982bed38464198b13be2a517b2db425e4f9e3af39f003248d
RedLineStealer
3e1a6299d80d53a831c2e6759ce2ac41e6d9aa6603cb2a1df7efbfb86debefa5
RedLineStealer
a78c6b44fa48674f8dc9572fd7ff9b15347dca01f9aa38d34fc18d688f92c4a4
RedLineStealer
ba5f4ef06d9953d76083e7c6bc7d762cb9b667038f14a95021002708b73f65ec
RedLineStealer
bf7cfd220d44eba42f39dc189cef99116ca1036f43a9324b9cc3f04bb7a19d6f
RedLineStealer
+ 5'356 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/220321-g5gq6shec2/
Behaviour
Program crash
Drops file in Windows directory
Unpacked files
SH256 hash:
85123cf39bcb8bc9f745fc3b6780d98f632d692c13b9617f7486b0309fb4c731
MD5 hash:
78f634f471cba1806484e50b44e97616
SHA1 hash:
155e05e57282fb9b7b11e11fced9b81ff8289619
Link:
https://www.unpac.me/results/d3ea8d96-308c-4d82-b2a8-a71848edfbc9/
SH256 hash:
37c049157faeff0dc3da0ef13628e7de348ffa66a2d8bf089483b51991352f6c
MD5 hash:
51333d465f4a3c662230825cf6071825
SHA1 hash:
c79570de7ea44f107e35abd5f57741fb17972ec6
Link:
https://www.unpac.me/results/d3ea8d96-308c-4d82-b2a8-a71848edfbc9/
SH256 hash:
b517436f70d5299ff5decc0c61ea633cd19204f90b2e048a598b24909c434254
MD5 hash:
38aa19be7c9df9e5956c6b2770133347
SHA1 hash:
b1053686702d07100cf84063f2050b8cd0e033a7
Link:
https://www.unpac.me/results/d3ea8d96-308c-4d82-b2a8-a71848edfbc9/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b517436f70d5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/b517436f70d5299ff5decc0c61ea633cd19204f90b2e048a598b24909c434254

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/253246/

Comments