MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfbbd4b5c26f2cde1082d54c490c3f13ee8510e3223c9d07c52910568a2948d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfbbd4b5c26f2cde1082d54c490c3f13ee8510e3223c9d07c52910568a2948d7
SHA3-384 hash: 972350baa4eb3184757436ecc2076c50028d715e9d3bf38f50e09058d8fd3313ae6bf72a40accc211f53198fd5067efa
SHA1 hash: b768494e7a8044be336247de62c90d893a4cac2e
MD5 hash: 3a25a3b49aebc374d28e83c4f7a07ebb
humanhash: harry-illinois-burger-music
File name:3a25a3b49aebc374d28e83c4f7a07ebb.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:331'776 bytes
First seen:2021-04-22 06:14:25 UTC
Last seen:2021-04-22 07:19:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cb9d63f797831e593075010586be1d1 (2 x RedLineStealer, 1 x TaurusStealer)
ssdeep 6144:jJZ4aAQ+zGLGsar9ceMzRHz26cxnXKxsd9DNv0g9fW1x8hOlPWR:jMaAQZkJceMFHi6yXZdBNv0ecxoOVO
Threatray 516 similar samples on MalwareBazaar
TLSH 1964CF10B3E1C132D1A256754725C3B18EBF78766439998FBBC01BB90F253E1EE16B1A
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3a25a3b49aebc374d28e83c4f7a07ebb.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-22 06:51:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/33997f9d-a876-4bd9-a7ee-441b68f08ff3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/143535/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.64684.14419.4234.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/692485
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfbbd4b5c26f2cde1082d54c490c3f13ee8510e3223c9d07c52910568a2948d7/
Threat name:
Win32.Backdoor.Convagent
Create hunting rule
Status:
Malicious
First seen:
2021-04-21 20:51:12 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3655jnocn4wn4eec2vgesdb7cpxikehdei6j2b6ffeifncrjjdlq._file
Verdict:
malicious
Similar samples:
048b796fb78b1a11d598189410f4de21f57094d283fbebaec36fc604b1f66197
RedLineStealer
254f8a160343897dc3e748af2f4c2164455afe3daaa75654c0a7e13483a43f0c
RedLineStealer
2efb4d4bb7e9141474ee5ae3f8c40274c5ab675b33836ac31a8ec554dd76a9bf
RedLineStealer
425070c98bc33758009a547dff0b6ada696f791501a11f8b40f5f6686e518545
RedLineStealer
667d6191eab21dca3a07f01b287a4a4d35c719885b712eeaf3fedeeeb8b16e4f
RedLineStealer
76b9e7cad6719da5975a769160602a67877e0e1748375280831f1f25b4558f48
RedLineStealer
877c1cec3dce25939698f1f459f4b68a1d9ecdb3c7ebc82f241e136ead494731
RedLineStealer
94e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb
RedLineStealer
bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e
RedLineStealer
e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a
RedLineStealer
+ 506 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:118 infostealer
Link:
https://tria.ge/reports/210422-7mdw5lfxj6/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine Payload
Malware Config
C2 Extraction:
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dfbbd4b5c26f2cde1082d54c490c3f13ee8510e3223c9d07c52910568a2948d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe dfbbd4b5c26f2cde1082d54c490c3f13ee8510e3223c9d07c52910568a2948d7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1147433/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/143535/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-22 07:22:36 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [B0012.001] Anti-Static Analysis::Argument Obfuscation
2) [C0003.002] Communication Micro-objective::Connect Pipe::Interprocess Communication
3) [C0049] File System Micro-objective::Get File Attributes
4) [C0051] File System Micro-objective::Read File
5) [C0052] File System Micro-objective::Writes File
6) [C0007] Memory Micro-objective::Allocate Memory
7) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
8) [C0040] Process Micro-objective::Allocate Thread Local Storage
9) [C0041] Process Micro-objective::Set Thread Local Storage Value
10) [C0018] Process Micro-objective::Terminate Process