MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebd2638b8cb8c64f869779415eb8f6cb28da23a42f3301f55f5a40b931581634. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebd2638b8cb8c64f869779415eb8f6cb28da23a42f3301f55f5a40b931581634
SHA3-384 hash: 4b7e639da66527379d9fccbe0bdb9639c22c15f55e3b4d3a4102b8b3e29123fe9177aa1528c2f8977dff5a103e98d011
SHA1 hash: be925ca9f4434734fb26711c4e50b1d8e6baba6c
MD5 hash: 89ba3a26828c25d05dc1d712dca0ad11
humanhash: juliet-west-nitrogen-quiet
File name:Unicore.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'521'152 bytes
First seen:2021-11-13 19:37:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 15aeac4aa1d11f9ad3fc4c4ac7bb9468 (58 x RedLineStealer, 5 x RaccoonStealer, 3 x CoinMiner)
ssdeep 24576:2JhbiAsw0EFIOkKpH+8gI644p9Nz5vCRfp/Esom9NeVGeqlPmN4c8aHHcckEaHN1:26A0eIOJpHtOLp9x5vIfp/Om9New3Gb+
TLSH T1186533FDC941DE3EC5AAA3F6B6265C1E6279491ACFC9E39CE3058F13B215037E5004A9
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205531/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Trojan.Generic-9907417-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
DNS request
Launching a process
Launching the default Windows debugger (dwwin.exe)
Connection attempt
Sending a custom TCP request
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed wacatac
Link:
https://www.filescan.io/uploads/6190141ddec3347825a3c657/reports/fda45c7a-d3aa-4964-b184-b033728af628/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c86b11fe-cd03-4ff0-b330-b890cb1933b1
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888624
Signature
Allocates memory in foreign processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebd2638b8cb8c64f869779415eb8f6cb28da23a42f3301f55f5a40b931581634/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-13 19:38:08 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline evasion infostealer spyware trojan
Link:
https://tria.ge/reports/211113-ycdx9afdf7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Checks BIOS information in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
RedLine Payload
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
185.223.92.157:7659
Unpacked files
SH256 hash:
f21563c1c3e04f490a9bd882a1e0e2f87ddf91dc72de74346fcfcdf4bb3ba7da
MD5 hash:
f04e0b5b0099136bb5a01a527505a93d
SHA1 hash:
43d6e9db0e1cdb2e058d48708b5aee87d5270d45
Link:
https://www.unpac.me/results/c69e4419-4178-4d61-8d93-b12712f2f97c/
SH256 hash:
ebd2638b8cb8c64f869779415eb8f6cb28da23a42f3301f55f5a40b931581634
MD5 hash:
89ba3a26828c25d05dc1d712dca0ad11
SHA1 hash:
be925ca9f4434734fb26711c4e50b1d8e6baba6c
Link:
https://www.unpac.me/results/c69e4419-4178-4d61-8d93-b12712f2f97c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ebd2638b8cb8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ebd2638b8cb8c64f869779415eb8f6cb28da23a42f3301f55f5a40b931581634

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205531/

Comments