MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8356fad49709d2563d2707dbb09f4f1019e30a0ff5836047a11b3d1d84f4d62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8356fad49709d2563d2707dbb09f4f1019e30a0ff5836047a11b3d1d84f4d62
SHA3-384 hash: 06a2e544119b9fef98f57dcc23b520540af365819d22d0f893f48369573c33df2bd7970ea6a91e2ca717a403f18f11ae
SHA1 hash: 5a5cb774b59befe102fe04e93d9853cfbda3334b
MD5 hash: ce62304c3eff639e1b2352667a569b8a
humanhash: north-asparagus-nevada-pluto
File name:ce62304c3eff639e1b2352667a569b8a.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:282'112 bytes
First seen:2020-12-28 07:48:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2144f9c12885542d4a4f22de64e840e1 (26 x RedLineStealer, 24 x Smoke Loader, 13 x RaccoonStealer)
ssdeep 3072:KdxgpoLVTfElkKLOj0XEW+0oN0VCw6Jl6fDOTjD7klmFXxziaXII4MNdSCvEe1BE:jkPKw4EW+0oisH6y4laXlDIAzvZ1
TLSH 80541269FA49D160D602AC3CD3498FE004DEE5364BA20C19FD69C4E32D783B6C6B975A
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://frigals.xyz/IRemotePanel

Intelligence

File Origin
# of uploads :
1
# of downloads :
534
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
89488162f046f9382ee2ef48127f07f6.exe
Verdict:
Malicious activity
Analysis date:
2020-12-28 07:38:38 UTC
Tags:
evasion loader rat redline
Link:
https://app.any.run/tasks/4778dce8-9c50-4db8-8382-84c993ccb1b0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/570554
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8356fad49709d2563d2707dbb09f4f1019e30a0ff5836047a11b3d1d84f4d62/
Threat name:
Win32.Trojan.Zenpack
Create hunting rule
Status:
Malicious
First seen:
2020-12-27 19:10:02 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5a2w7lkjocosky6sob63wcpu6eaz4mfa75mdmbd2cgz5dwcpjvra._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/201228-9j8fe8jzye/
Behaviour
Suspicious use of AdjustPrivilegeToken
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
e8356fad49709d2563d2707dbb09f4f1019e30a0ff5836047a11b3d1d84f4d62
MD5 hash:
ce62304c3eff639e1b2352667a569b8a
SHA1 hash:
5a5cb774b59befe102fe04e93d9853cfbda3334b
Link:
https://www.unpac.me/results/00845362-4847-49f7-9e57-954443b5c7c6/
SH256 hash:
cd7d430e15b303bf747f9c95fcaaaf0565de0c5c989a49d38bb930eee9437475
MD5 hash:
f6f181d2070b12d0d8e5f70d6327f7db
SHA1 hash:
4b1287dae9656e469e7cf721b9a10b8f9b935a74
Link:
https://www.unpac.me/results/00845362-4847-49f7-9e57-954443b5c7c6/
SH256 hash:
5c220d81a6fd2cc66919a557dde8d16721ec0883d7347ea48bcbe53082ce663b
MD5 hash:
9d77998c39c0b82335e75256588c7b97
SHA1 hash:
049b5994c5c1f37dc05cccbad4864b943da5c17c
Detections:
win_redline_stealer_g0
Create hunting rule
Link:
https://www.unpac.me/results/00845362-4847-49f7-9e57-954443b5c7c6/
SH256 hash:
ae6ae0e59be9bc2959da5b4069f6d47befe41cdcdbba86b67e6d365a610c7443
MD5 hash:
04676f1c8c95ac27e5ed4bbf0c646a1f
SHA1 hash:
4a6a79087d796830cb4a04dc58d3c049386835e0
Detections:
win_redline_stealer_g0
Create hunting rule
Link:
https://www.unpac.me/results/00845362-4847-49f7-9e57-954443b5c7c6/
SH256 hash:
32d316793edd299b8b5f877a8144bb43df382cd32c248b2a0c0680573fe7efc7
MD5 hash:
3c1aa3c2a6be373909e92716326184ac
SHA1 hash:
eff95fa0f2302e2fed157ea8f64412e84bafbbb9
Link:
https://www.unpac.me/results/00845362-4847-49f7-9e57-954443b5c7c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/e8356fad49709d2563d2707dbb09f4f1019e30a0ff5836047a11b3d1d84f4d62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe e8356fad49709d2563d2707dbb09f4f1019e30a0ff5836047a11b3d1d84f4d62

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/941462/
  
Delivery method
Distributed via web download

Comments