MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a
SHA3-384 hash:	5b32a1aedeedafe57f70d19ab1f34a6caf03631a3641fbc360d130dd034069a66c2a280bece59c435f02bf185853c62c
SHA1 hash:	827697cbe8330e344117703942328d5ce2027f95
MD5 hash:	1d4f86998febcd63769ffabf86ad4177
humanhash:	alabama-hamper-ack-august
File name:	1d4f86998febcd63769ffabf86ad4177.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	404'480 bytes
First seen:	2021-03-05 14:01:07 UTC
Last seen:	2021-03-05 16:00:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	968cedb7b390d7827b338d9d8e9c175e (4 x RaccoonStealer, 1 x ArkeiStealer, 1 x RedLineStealer)
ssdeep	6144:+loJJKTt1xFqWW4jq8peRItZJOMlT0grlpy656KEmyQVSGoz:+S7Yt1xFqWw8peOXloghpfcKGzz
Threatray	314 similar samples on MalwareBazaar
TLSH	75849E10A7A1C035F2F376B84A7793FCA52A7AB1E73490CF16D126EA56346E09D31B13
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1d4f86998febcd63769ffabf86ad4177.exe

Verdict:

Malicious activity

Analysis date:

2021-03-05 14:06:47 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/c1016ee2-5ed4-4270-b512-2723b9f498d6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/122489/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.22239.25186.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending an HTTP POST request

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file in the %temp% directory

Deleting a recently created file

Creating a file

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/630033

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Potential time zone aware malware

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redlinestealer

Link:

https://mwdb.cert.pl/sample/e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2021-03-05 14:02:08 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Verdict:

malicious

RedLineStealer

475fb56e0d04331b71ef82cd98e61b377a8ece08a57345f18806fd367718bbc2

RedLineStealer

63c9bab720391433d6195ee41da8a049281f5c8e2ea20d074961bf31b93986a0

RedLineStealer

676593610aafb444bd3b06028cbe14c0f1bb08d621da061609436d0afbe536fb

RedLineStealer

6846c70c5392556654844ce2e05e68f248432176c88d2b92f44b1b487c6b7db3

RedLineStealer

94e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb

RedLineStealer

96802cd1e7ee797e260cf5379cdd8526379b6ab1c396c21f1db1dae4ca111e93

RedLineStealer

a3948163bc436fde2808c4c76fccc90d515f3d754fc5851f0eb1e8b40a539e2b

RedLineStealer

e0e1df2e713258532e08c09458ad6f5e50163b1e7c9c1f1446f0023c4e479bef

RedLineStealer

f4c347b4a344291c7e62fc77734b3e403358723874f7460ea4e2a6f2c3659b48

RedLineStealer

+ 304 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware

Link:

https://tria.ge/reports/210305-8tbz2j6xjx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Unpacked files

SH256 hash:

4c160874473ea890da29feae630ae01b513d010424f03fbe68fd36348425b46d

MD5 hash:

c55acf224fcd3c6f126571328333da26

SHA1 hash:

92c1ea3bfcab4d5c6aef2a29de871c4d193f6012

Link:

https://www.unpac.me/results/22b05164-961c-4c3c-b4c0-8096b3fc6a20/

SH256 hash:

b88a450ce3914d1502081bccbe70e6a8920b2089689688fd2356cc2dcef8724e

MD5 hash:

b6fd195fa14df407bafafec4a36dd3e4

SHA1 hash:

62f03981053a6075e396c8feae897b4be9fea186

Link:

https://www.unpac.me/results/22b05164-961c-4c3c-b4c0-8096b3fc6a20/

SH256 hash:

70db5ea41576ad347869e691a7896760a5228695be9e962345e376c47d6e87d6

MD5 hash:

e6bc17c39f5e9d79afce0304c3340282

SHA1 hash:

22d948eb49356c5a932ca7a2ddb5608b38266050

Link:

https://www.unpac.me/results/22b05164-961c-4c3c-b4c0-8096b3fc6a20/

SH256 hash:

e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a

MD5 hash:

1d4f86998febcd63769ffabf86ad4177

SHA1 hash:

827697cbe8330e344117703942328d5ce2027f95

Link:

https://www.unpac.me/results/22b05164-961c-4c3c-b4c0-8096b3fc6a20/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.