MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cd71be4c68543a67557c0a3298ec184f9d60e8c84237aa598e351c056d884b5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 12
| SHA256 hash: | cd71be4c68543a67557c0a3298ec184f9d60e8c84237aa598e351c056d884b5f |
|---|---|
| SHA3-384 hash: | d03373ef18f90d51211d0dc4e323c8246703fab435b3eee1e60b70c43c7914e7b51e5064df4e8d053c1a0b65151de8df |
| SHA1 hash: | 7d33791ed6641b2a56c6991f6bbb4f3671dcfd1f |
| MD5 hash: | c3db750d60ba421e7abce39df3db36a0 |
| humanhash: | dakota-delta-hawaii-georgia |
| File name: | QUOTEGMC 92304882399300PDF.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 694'272 bytes |
| First seen: | 2021-07-26 21:20:45 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:iOsBgo0q4wMPQsTFVp15Ako1YGKuUdR0DB0t/SiyyjK:iOsBgo0q4wM4sTFVp93/dS0Bd8 |
| Threatray | 893 similar samples on MalwareBazaar |
| TLSH | T1DAE47ED23159BA4BF04318FA14BED16114B468DEC469CB4D7713AA27EEE7343209778E |
| dhash icon | f29296968e9e9ea6 (60 x AgentTesla, 37 x RedLineStealer, 35 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 2.56.59.84:43393 | https://threatfox.abuse.ch/ioc/163074/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTEGMC 92304882399300PDF.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-26 21:23:18 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Reline
Status:
Malicious
First seen:
2021-07-26 21:21:03 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 883 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline infostealer
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
CustAttr .NET packer
RedLine
RedLine Payload
Malware Config
C2 Extraction:
biggz957.duckdns.org:43393
Unpacked files
SH256 hash:
d5a01e1c2f58fe303b69f1222d9d479a53bc38eca367e812ac9a7193b52ebf9f
MD5 hash:
01defad1ad8b215fd935eef4f439249e
SHA1 hash:
f99600334f80cac9204beb6b3e452fd03e714f1f
SH256 hash:
97d2fa1d01b2f9a2199896e05e0cf60c14a9f41ef2d72e15fbb862b7afa08438
MD5 hash:
68463851c0e6fe7a254c99fae763d454
SHA1 hash:
4587a5371d88c296a0184fe47ee0c5245b187127
SH256 hash:
ed5a1f54ee58241794f2b54a211a68088cbb629f70609c86857dad5d1eb09719
MD5 hash:
eac494a112e8cd0d694b5884918a9436
SHA1 hash:
11ae3430842a0f9d490e472ae5c8d7f79a13dfc7
SH256 hash:
2dae6dbfb427bf16de802cd0943265d272b5386b4690b5ec74ecd7346298112f
MD5 hash:
d282f6131d5477a3dcf0299b4d1728ee
SHA1 hash:
0428b8168152b9842cd08774a952b959db8f3fc9
SH256 hash:
cd71be4c68543a67557c0a3298ec184f9d60e8c84237aa598e351c056d884b5f
MD5 hash:
c3db750d60ba421e7abce39df3db36a0
SHA1 hash:
7d33791ed6641b2a56c6991f6bbb4f3671dcfd1f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.