MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 dbb953f1943fa6f07fcaad4f4469fc48a19dc1df34b2502ea8c7b789bedbfade. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 8
| SHA256 hash: | dbb953f1943fa6f07fcaad4f4469fc48a19dc1df34b2502ea8c7b789bedbfade |
|---|---|
| SHA3-384 hash: | a007711ea987f41567276fed7c69520994a003b58e8cd82f628bd87f8ff280eec1c6423df001c7ec006995bbc5926bf9 |
| SHA1 hash: | 78b2fd6bc44216b8717fec509c26f22243d4cd4c |
| MD5 hash: | b24da9af7018b04f2f77d76aa868ea80 |
| humanhash: | eleven-solar-ten-bacon |
| File name: | b24da9af7018b04f2f77d76aa868ea80.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 299'520 bytes |
| First seen: | 2020-11-01 07:24:08 UTC |
| Last seen: | 2020-11-01 08:47:56 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0e491bfc86cb6900f60348f198b356ef (6 x Tofsee, 2 x RedLineStealer, 2 x CoinMiner) |
| ssdeep | 6144:B79Q7RMb3Y9MMJxelJEiSyivaWnZnZdr+BB+:lGAY9MMJsPEiSykaSdKf |
| Threatray | 153 similar samples on MalwareBazaar |
| TLSH | 8D54E00222D2C071C59716765425CB694FBF347A29366A8F2FEACABD5F247D1DB2430C |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Connection attempt to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
76 / 100
Signature
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potential time zone aware malware
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Zenpak
Status:
Malicious
First seen:
2020-10-29 12:08:49 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 143 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
dbb953f1943fa6f07fcaad4f4469fc48a19dc1df34b2502ea8c7b789bedbfade
MD5 hash:
b24da9af7018b04f2f77d76aa868ea80
SHA1 hash:
78b2fd6bc44216b8717fec509c26f22243d4cd4c
SH256 hash:
b5a127e89b5dd04ef2e9240268916d8c6f48c103d031fa93a0d817c12882859e
MD5 hash:
a07ad01df4d4fff552ce885fe75501a9
SHA1 hash:
1422aef2f1ce2aaaa41fbfc1121e94b506415d97
SH256 hash:
2eda8fee8423130479e6a26a1aa7f9e995dd5081ee5721da2f44812cb3545f5f
MD5 hash:
31ee1eb729b575753d40da25c41f4b2a
SHA1 hash:
5bfff10e2d3037ede50376d5a217507d1e2861b7
Detections:
win_redline_stealer_g0
SH256 hash:
222e761608cbcb6bbc9048879692265aa6a1f5f1b8f37781a53782d0f3448bb6
MD5 hash:
d1b21531f5f5a2098ed194d2a2027094
SHA1 hash:
85923f713b150da51a800b0ff2daaa7240f6fc7c
Detections:
win_redline_stealer_g0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.