MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c30d45a309b85b010bc04905b7f43d81926a60c7e8c5f387b659517425ce083b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	c30d45a309b85b010bc04905b7f43d81926a60c7e8c5f387b659517425ce083b
SHA3-384 hash:	53be5979cbea497509af58cbc728dea3df10cd52002c3830d95ff681a43eb67b06d4de97e223dc4954b10bfe5f8e101c
SHA1 hash:	53ab2be96f124d23706304c4109d03276d4ba58f
MD5 hash:	46c84e26e75238c5c743e1e4a7f51291
humanhash:	seventeen-leopard-apart-batman
File name:	46c84e26e75238c5c743e1e4a7f51291.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	350'208 bytes
First seen:	2021-01-05 09:07:53 UTC
Last seen:	2021-01-05 10:06:32 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	07f4b8d04a6c7c6849e19c8b4e0aa8bc (1 x ArkeiStealer, 1 x RedLineStealer, 1 x RaccoonStealer)
ssdeep	6144:VJNu18kkLYCVo52Ha9rXPn4YCuQIw2LgsEs:JDzVJHTYtQIwLO
TLSH	E67412469E4A8813C9B0743042368767735CF9683BCAFF0F79AD3E9B1936E9A6443153
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
http://oribba.xyz/IRemotePanel

Intelligence

File Origin

# of uploads :

# of downloads :

253

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6c985e92abdaf13871578f0e147b6f23.exe

Verdict:

Malicious activity

Analysis date:

2021-01-05 07:45:12 UTC

Tags:

evasion loader rat redline trojan phishing stealer

Link:

https://app.any.run/tasks/664ca0be-248a-4f5e-9c07-24f0ca63773f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/110535/

Detection(s):

PUA.Win.Packer.Upolyx-12

PUA.Win.Packer.Upx-4

SecuriteInfo.com.Trojan.GenericKD.45336267.8601.24654.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Creating a file

Sending a UDP request

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Ficker Stealer RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/574002

Signature

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Ficker Stealer

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c30d45a309b85b010bc04905b7f43d81926a60c7e8c5f387b659517425ce083b/

Threat name:

Win32.Trojan.Pwsx

Status:

Malicious

First seen:

2021-01-05 06:57:00 UTC

AV detection:

12 of 28 (42.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ymguliyjxbnqcc6ajec3p5b5qgjguygh5dc7hb5wlfixijooba5q._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:agenttesla family:redline discovery infostealer keylogger spyware stealer trojan upx

Link:

https://tria.ge/reports/210105-fd8r16wn3a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks installed software on the system

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

RedLine

Unpacked files

SH256 hash:

c30d45a309b85b010bc04905b7f43d81926a60c7e8c5f387b659517425ce083b

MD5 hash:

46c84e26e75238c5c743e1e4a7f51291

SHA1 hash:

53ab2be96f124d23706304c4109d03276d4ba58f

Link:

https://www.unpac.me/results/2c0b74ac-dbcb-4b7f-9289-b244729e8c31/

SH256 hash:

a5c4f3e740cd9707ee66dc17f3f9f424d67cfd79cb6326d2787848533642977c

MD5 hash:

5d0cd181a4ce09c445319314de897f5e

SHA1 hash:

80c6d85abc6eab73395a1a7ec43ce45a507f8f3a

Link:

https://www.unpac.me/results/2c0b74ac-dbcb-4b7f-9289-b244729e8c31/

SH256 hash:

c6c6a3b5f0b879a9036809d91d891487e98b9a6f3a9b82011f770a4ce64ef80c

MD5 hash:

0f7fa914eb03b67cebd8fbbd95838472

SHA1 hash:

01c093d485d994c0d624140e78d014ca03a1928b

Detections:

win_redline_stealer_g0

Link:

https://www.unpac.me/results/2c0b74ac-dbcb-4b7f-9289-b244729e8c31/

SH256 hash:

2c597af5128f49335ddb718d9c2d88c46485e8d3dbbbbf39aa6fc3db14763455

MD5 hash:

619b9cea075815334f6093a07fdabce6

SHA1 hash:

55fea896d034842496ac730b0e32eed61efdc021

Detections:

win_redline_stealer_g0

Link:

https://www.unpac.me/results/2c0b74ac-dbcb-4b7f-9289-b244729e8c31/

SH256 hash:

a598c0e5d1760e4f80bbf3a5aac5f49c3f6bc0290eac05836c6b5751f445d71b

MD5 hash:

261c595403804399d028ff54b86caa23

SHA1 hash:

58d84ca017168074a23755bb24898a10831be3b9

Link:

https://www.unpac.me/results/2c0b74ac-dbcb-4b7f-9289-b244729e8c31/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c30d45a309b85b010bc04905b7f43d81926a60c7e8c5f387b659517425ce083b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekshen
Description:	Detects RedLine infostealer

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/