MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d34ef9018fe160ad28ce30d039fac14ffb5023b6e11e1d6e67f1265d68791c8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d34ef9018fe160ad28ce30d039fac14ffb5023b6e11e1d6e67f1265d68791c8c
SHA3-384 hash: 217d46452c4d7784198586e864a4386f41d2bd094474ddcce2d647e588906b7e7f27854a7c08216d9db368e8eeec8e07
SHA1 hash: b07d274d2c11424c21e349ff120f9e29b0f81fb4
MD5 hash: 63845cc49983c0ba39d72bc05f740dac
humanhash: single-football-potato-juliet
File name:Order_Confirmation.pdf ..exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:751'192 bytes
First seen:2021-07-29 06:12:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:/Y7l5Pd6HdP6FPiP6dYoDAVGnNS6VWC7dK:w5c9iJiXobQuxK
Threatray 89 similar samples on MalwareBazaar
TLSH T129F4033066FAC2C2C59838B4EC8BB0F44A50EE56D6658C9FBC883E0A35F16D9F57215D
dhash icon 316d4d4d554d4d33 (2 x BitRAT, 2 x RedLineStealer, 1 x AgentTesla)
Reporter lowmal3
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
22d9e3f9-1100-496e-b88c-00284b57bb53
Verdict:
Malicious activity
Analysis date:
2021-07-29 06:13:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0b5e1a0c-69c7-42dd-9081-d1a94fa38763

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174872/
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ee70b0d-457d-4758-854f-23a281b8336b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/823571
Signature
.NET source code contains potential unpacker
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Uses powershell Test-Connection to delay payload execution;
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 455983 Sample: ..exe Startdate: 29/07/2021 Architecture: WINDOWS Score: 68 32 google.com 2->32 40 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 .NET source code contains potential unpacker 2->44 46 2 other signatures 2->46 8       ..exe 3 2->8         started        signatures3 process4 signatures5 48 Uses powershell Test-Connection to delay payload execution; 8->48 11 powershell.exe 16 8->11         started        14 powershell.exe 16 8->14         started        16 powershell.exe 15 8->16         started        18 3 other processes 8->18 process6 dnsIp7 34 google.com 11->34 20 conhost.exe 11->20         started        36 google.com 14->36 22 conhost.exe 14->22         started        38 192.168.2.1 unknown unknown 16->38 24 conhost.exe 16->24         started        26 conhost.exe 18->26         started        28 conhost.exe 18->28         started        30 conhost.exe 18->30         started        process8
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.Rrat
Create hunting rule
Status:
Malicious
First seen:
2021-07-29 03:20:24 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2nhpsamp4fqk2kgogdidt6wbj75vai5w4epb23th6etf22dzdsga._file
Verdict:
unknown
Similar samples:
0b6311976a5d7d94c5bf373e982e9e03ea64cb4869b9399fb1f90c122cb2ced2
RedLineStealer
4786c4e0b64e49ed37f8215c2b6c778ec6c7b31a4d044cab66d46c904c6a7cba
RedLineStealer
52309c4bfd0f4a78a05edff800c412760c488ef60f6709f6f9038dc1f315f17a
RedLineStealer
784ed80931d639300835a664cc07fa838cb984e3a910aa6568dfb9820e73cba3
RedLineStealer
898216543dfbe03ead8ae9e2963d972b1963da5e00addab93702a9ec1a4b216a
RedLineStealer
96a8399aef7760c49b1b2fd59de6f8747f5de3bf85249c5d7e09e7499a5c097f
RedLineStealer
a73bae0022c8d7e7a0daf987bc193355748c960d3eba65059072687e8743c552
RedLineStealer
b3124db4cffc55f2d3ee216ea71ea422ad3d4d7ff025d068a4cc2261fa43e4b3
RedLineStealer
b74d77c359b3eea168c342dda78f18f8afaf6379763ca8221e91ebdf1673d4f0
RedLineStealer
bc57e420dec21d7e6a08748c9a531cbdbddf2251e656492521a4f16b692c23f5
RedLineStealer
+ 79 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210729-md8m83j1ks/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
d34ef9018fe160ad28ce30d039fac14ffb5023b6e11e1d6e67f1265d68791c8c
MD5 hash:
63845cc49983c0ba39d72bc05f740dac
SHA1 hash:
b07d274d2c11424c21e349ff120f9e29b0f81fb4
Link:
https://www.unpac.me/results/3f6adc21-5590-4f4d-840c-e4739155c05a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/d34ef9018fe160ad28ce30d039fac14ffb5023b6e11e1d6e67f1265d68791c8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

Executable exe d34ef9018fe160ad28ce30d039fac14ffb5023b6e11e1d6e67f1265d68791c8c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/174872/

Comments