MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec837014dcb222fd3780d0730e297c9a09786cc57a42a9da092c9199c1f9660b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec837014dcb222fd3780d0730e297c9a09786cc57a42a9da092c9199c1f9660b
SHA3-384 hash: eac55b668cd2d72ef5b58916c7903aa20591707d0b3d1481e22984d1d3fc61c132b608cf244be20488b2bcc4638cc502
SHA1 hash: 7e4e2e4818efc703a5995dc4a512e59446b24308
MD5 hash: 1301cdb555ef4316799d828e47989403
humanhash: robert-stream-moon-leopard
File name:SecuriteInfo.com.Variant.Ser.Ursu.25183.2024.20532
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:640'000 bytes
First seen:2020-06-14 11:42:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f51eb311c7cea4e47d027b8a8dc52b8 (1 x DanaBot, 1 x RedLineStealer)
ssdeep 12288:HMHkKCTPwpff4yLTih6ZNcFbFtbz78KEw7yNkwm9:RopIWbIHb/8KIqwm9
Threatray 100 similar samples on MalwareBazaar
TLSH 2DD4020236F0D071D5B722B249599AA13A7DFFB14631994B73C8370F9E706D0AA26B73
Reporter SecuriteInfoCom
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10171/
Detection(s):
SecuriteInfo.com.Variant.Ser.Ursu.25183.2024.20532.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 16:30:11 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5sbxafg4wirp2n4a2bzq4kl4tiexq3gfpjbktwqjfsiztqpzmyfq._file
Verdict:
malicious
Similar samples:
0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb
RedLineStealer
1c76b631dd54f736e8bf3c822ab85e167c91fa18f19b7f38cc57e0aa4cfb6511
RedLineStealer
34e142c3ca75844c48639cfc8f60513d23c02a65addef3bce69f5b49b34277a1
RedLineStealer
358178b74d9ff1457dab5015e5d10aa18a3b95d50a5a821568886672dfde97f3
RedLineStealer
41d2f9ef245a688081894e9983a5094d9beb6d84bda7d057ecc15a247aea6a06
RedLineStealer
44ccaaf3cc76edd1e184d8c65b13db79638fcbf8ed37b5883c34a1a8a7700901
RedLineStealer
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
RedLineStealer
5ef8714caf9c7296847b67b27edb93c3aec23d7e77b57d23d0e8607d707a2c49
RedLineStealer
b47f74419de5db79da95d6d39d6e7e0da43a2bb2dc5770a0ee3715bcb2d76299
RedLineStealer
c2a307a15f392b72cc51b12a1061c6ad7a2e76843754ee3d2e7b8ba0bc17e540
RedLineStealer
+ 90 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-qlq4lt6d42/
Behaviour
Checks processor information in registry
Modifies system certificate store
Legitimate hosting services abused for malware hosting/C2
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Unknown_PWDumper_Apr18_3
Create hunting rule
Author:Florian Roth
Description:Detects sample from unknown sample set - IL origin
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ec837014dcb222fd3780d0730e297c9a09786cc57a42a9da092c9199c1f9660b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/389801/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/10171/

Comments