MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c41873f177a61ec1e1cb628db96cddd70204b8a530e392bf210d7d4136be7375. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c41873f177a61ec1e1cb628db96cddd70204b8a530e392bf210d7d4136be7375
SHA3-384 hash:	eb103323b6f910b30b5c52bd143bdfba5a3c49ead9e9532444bdbb8e2cea0ce9ba060b7bf685b3485d4d0eef16eb3912
SHA1 hash:	dfffb1803fd550d5b794b3c78516f7cc76b77e53
MD5 hash:	be8bd2950d34966c2af7ccf59a64d8e2
humanhash:	friend-bravo-uncle-north
File name:	redd.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'028'096 bytes
First seen:	2020-08-24 12:48:08 UTC
Last seen:	2020-08-24 13:45:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:oMDJX6ZSp1Iz8D9JfxDyj4PSJdCNln2oewRd5sL3/OwItfBL/y1CQLud76wHHW2A:o8JX6ZSEkJpu/CGoVr5Rtq66wH6
Threatray	70 similar samples on MalwareBazaar
TLSH	1325CF8367039725D4140F70488D66909B2CECB3BE24F93EB1583B66A7B72E6B51363D
Reporter	JAMESWT_WT
Tags:	RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50257/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.53867.18859.322.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Deleting a recently created file

Reading critical registry keys

Replacing files

Running batch commands

Searching for the window

Launching a process

Connection attempt to an infection source

Stealing user critical data

Launching a tool to kill processes

Sending an HTTP POST request to an infection source

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/447597

Signature

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Uses known network protocols on non-standard ports

Yara detected AntiVM_3

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c41873f177a61ec1e1cb628db96cddd70204b8a530e392bf210d7d4136be7375/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-08-23 17:41:25 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Verdict:

malicious

Label(s):

agenttesla

RedLineStealer

3ee692779441b3a14699edc0f9ad269c58281d5735c570a9468f077739db26dd

RedLineStealer

692dc7ac48dfa381cd7f860236876e3621af2e1dc984b8f14cad498e412e88d8

RedLineStealer

cfac75f3ee6ba6f7816e73908f679a7c185b12044580c1f6b0cbf41dfe74b0f7

RedLineStealer

d0e642197915ade19fb4c2df299063e49ed7f650e4b3b6ee90d4f0d626b900c3

RedLineStealer

dbbc9e640af23658de56eba2f5ec2152de38fa35f11343f0d2216b8b5d7967a8

RedLineStealer

e8406edde4743eec38d88fd58f2c79b11d09d76bcd57b757cdf5844ea5bd55e7

RedLineStealer

ed1a371e8918f6f1dde9fad1e3edb2c984ea3704217e2bca5b2489b61d1bc56e

RedLineStealer

ee5330d0a01cd004994c5798a3c0c09b160b560e6cdb3f2509b9af2431a0a8fd

RedLineStealer

f208226c60c95ee10f879f0f38ad9bf85a30fa411d6d20893e9ddaea5a0daf20

RedLineStealer

+ 60 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

keylogger stealer trojan spyware family:agenttesla discovery infostealer family:redline

Link:

https://tria.ge/reports/200824-wy1mq3sgqx/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks installed software on the system

Looks up external IP address via web service

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

RedLine

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c41873f177a61ec1e1cb628db96cddd70204b8a530e392bf210d7d4136be7375

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.