MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c79ba9cb463e75edc177470625dd9e66ed8ae09a0cb26686e661759e252765cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c79ba9cb463e75edc177470625dd9e66ed8ae09a0cb26686e661759e252765cc
SHA3-384 hash: 7a04f7eaa41fa77903f21cddc9f8ebae82a8f9ddc9ffeae887a9592a36e90680aeb0f6fdeec35f1f5ddc27dd4d63a804
SHA1 hash: 693f7e488e1b686bc42943a3087314ab7299a5cd
MD5 hash: 664aad2f432cc42dac39c9cba69f15a2
humanhash: thirteen-winter-fifteen-sink
File name:SecuriteInfo.com.Trojan.Win32.Save.a.20452.2088
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:643'584 bytes
First seen:2021-03-04 18:35:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:onCJUnw6zryDQOKX2Ay9bwmSPB6VKYG9LvIrqY5zF4Q+FNEUNKIUGSW31v:oCD6fyLKzmSPB6V3GWqaOQ+xKIUaB
Threatray 30 similar samples on MalwareBazaar
TLSH 1BD4E66D2218AF98E0BA833BD41455944FF5ED1EB32CCB567F8963CD2465E40CE63E22
Reporter SecuriteInfoCom
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Kalimabors.exe
Verdict:
Malicious activity
Analysis date:
2021-03-04 14:57:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/caa0e106-3e19-4f65-a7e2-ce383d155ab1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122335/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.20452.2088.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Connection attempt
Forced shutdown of a system process
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/629035
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PowerShell case anomaly found
Powershell drops PE file
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 363488 Sample: SecuriteInfo.com.Trojan.Win... Startdate: 04/03/2021 Architecture: WINDOWS Score: 100 36 Antivirus detection for dropped file 2->36 38 Antivirus / Scanner detection for submitted sample 2->38 40 Multi AV Scanner detection for dropped file 2->40 42 7 other signatures 2->42 7 SecuriteInfo.com.Trojan.Win32.Save.a.20452.exe 3 2->7         started        11 Radikolad.exe 3 2->11         started        process3 file4 28 SecuriteInfo.com.T...ave.a.20452.exe.log, ASCII 7->28 dropped 44 Writes to foreign memory regions 7->44 46 PowerShell case anomaly found 7->46 48 Injects a PE file into a foreign processes 7->48 13 powershell.exe 15 7->13         started        17 RegAsm.exe 15 2 7->17         started        20 RegAsm.exe 7->20         started        22 RegAsm.exe 2 11->22         started        24 RegAsm.exe 11->24         started        signatures5 process6 dnsIp7 30 C:\Users\user\AppData\...\Radikolad.exe, PE32 13->30 dropped 32 C:\Users\...\Radikolad.exe:Zone.Identifier, ASCII 13->32 dropped 50 Drops PE files to the startup folder 13->50 52 Powershell drops PE file 13->52 26 conhost.exe 13->26         started        34 185.174.102.97, 3214 ASN-QUADRANET-GLOBALUS Ukraine 17->34 file8 signatures9 process10
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c79ba9cb463e75edc177470625dd9e66ed8ae09a0cb26686e661759e252765cc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 16:35:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6n2ts2ghz263qlxi4dclxm6m3wyvye2bszgnbxgmf2z4jjhmxga._file
Verdict:
malicious
Similar samples:
0ebfb9888d15c1377eb933a088f7aa3dd228523ffee36d7f8718c49d976dab6c
RedLineStealer
1c5de33a75e4c9bebf045767ff494bbc8c12eae88989ab91466815f86ee312ca
RedLineStealer
2cd722bc4e448f38f4e79e69a48a7fc3f92c09586e50bc0f3f9f8dc5f4495fcc
RedLineStealer
4d94148f1dff68b03896e3fa5508c5b039b0a29b1fd90db01884137f2e9495a4
RedLineStealer
79d5b3a1a8b602ecb6ffb87e5c42acdaa4403e81cb3dcf859e573392c2350dc0
RedLineStealer
afc5d1c659bc8b4d23ab16bd112dce9bcdada2d17f7bcbc589290cbb8cb281c3
RedLineStealer
b3aaccdc1085c2345fa97dee0864226062342c0f746ef0b91cd885f173ea572a
RedLineStealer
b680156ec148a3ca3a4f0ebde18e88484430a9cd15e0f1ef5e4225a6d2bf00a7
RedLineStealer
c3e4279a43450ead744ae1ccb4eebce1feb6017ef3a8f2f0a1b3f602922913a0
RedLineStealer
e401a949ac7801d662b4f05acb3dc55e604de12632f032c6efecbc607a848ba9
RedLineStealer
+ 20 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210304-cv8wlmbhra/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Unpacked files
SH256 hash:
3fe966e21625f83eccdcc49762305a16e6c488397b4e08a98e1be48d93c3a571
MD5 hash:
884c22791622cbd6edc8ad0dfcea87f2
SHA1 hash:
8b2b539c86f49597a05a289fda4ac27b2fd1c177
Link:
https://www.unpac.me/results/bab40127-8e57-4cc2-9bce-2f10937c1c52/
Parent samples :
fb50faa852bc2917ace3552b02c754c91872d0892e247f51a1e48336e598d6ef
6f97024532dc240921683a3769cb317aefc60bf89c8916b01e80a804675f7487
8e36d4f98a882487bedbedf73cbb010f793c7bb529d133a58673a14850198f9f
SH256 hash:
d6e09885be66791f19c877cbcf4d1b6ee5e290ae2ed70a76ce905376b470b278
MD5 hash:
a3bbb8e3f646c07acf8153de5df11488
SHA1 hash:
e4372b0b7aa90b31fdb9ba8d811ea9448c64016e
Link:
https://www.unpac.me/results/bab40127-8e57-4cc2-9bce-2f10937c1c52/
SH256 hash:
c79ba9cb463e75edc177470625dd9e66ed8ae09a0cb26686e661759e252765cc
MD5 hash:
664aad2f432cc42dac39c9cba69f15a2
SHA1 hash:
693f7e488e1b686bc42943a3087314ab7299a5cd
Link:
https://www.unpac.me/results/bab40127-8e57-4cc2-9bce-2f10937c1c52/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c79ba9cb463e75edc177470625dd9e66ed8ae09a0cb26686e661759e252765cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe c79ba9cb463e75edc177470625dd9e66ed8ae09a0cb26686e661759e252765cc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1046971/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/122335/

Comments