MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be
SHA3-384 hash: ac5eef6fffd5be4bad709802a41f68e4db1853d7029f7f21c206e526b01115f4eb5643a1af93eb32285988c233563dae
SHA1 hash: 3ec551a27ca6a30302779a6e9b7b4100431b393b
MD5 hash: 681a63126f0b9842cc64ffcfdc611e14
humanhash: kansas-princess-artist-iowa
File name:681a63126f0b9842cc64ffcfdc611e14
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'748'416 bytes
First seen:2021-06-24 01:11:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 49152:BSrucL2/MFcpMllYQp3fJjNTwIoKL5Hl1isFOf7fd9z:BiucLkXGEGLl/Ofp9z
Threatray 15 similar samples on MalwareBazaar
TLSH 53D54A02BE04CA02F01D1137D1DF410887F4EC426AEAE727BEA9776D54663A37C5D9EA
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3a394b794188405145b5dc9fb429d21fb825cf96.exe
Verdict:
Malicious activity
Analysis date:
2021-06-23 20:21:35 UTC
Tags:
trojan rat redline stealer loader
Link:
https://app.any.run/tasks/79071995-4067-4d0d-8ef2-28affaae02ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35069c45-ac2b-430d-b856-cdb9971e85e6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/807028
Signature
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 439441 Sample: dUHf4W45fC Startdate: 24/06/2021 Architecture: WINDOWS Score: 52 26 Multi AV Scanner detection for submitted file 2->26 7 dUHf4W45fC.exe 14 3 2->7         started        11 dUHf4W45fC.exe 1 2->11         started        14 dUHf4W45fC.exe 2->14         started        16 dUHf4W45fC.exe 2->16         started        process3 dnsIp4 24 176.111.174.107, 49710, 80 WILWAWPL Russian Federation 7->24 28 Uses schtasks.exe or at.exe to add and modify task schedules 7->28 18 schtasks.exe 1 7->18         started        22 C:\Users\user\AppData\...\dUHf4W45fC.exe.log, ASCII 11->22 dropped file5 signatures6 process7 process8 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 17:14:48 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1c0eb090ad769cdd943476e9300d57e553ad24f099408334b8c0370ee9bb7648
RedLineStealer
200b64a2d1d30811d3feae4a361bd652104ecc7ac98c7c4804f0bbf2bb47028e
RedLineStealer
47f55d901f3a0fcc649afa6e44bd4307fffd877ac92a33fde21992a93e54b27d
RedLineStealer
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
RedLineStealer
79afc9b39ba7fe7dd6ed282d39eb915bb47271d552177f62c6606b99901f9cd2
RedLineStealer
916df1aaac228a40f1981b539742aee6d0009fdce746f14eb646a7c70fa2cc4d
RedLineStealer
9a693191c99ec28e49e610cd89af5137fb077ad8b4d7452828dbabd055e65384
RedLineStealer
9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc
RedLineStealer
ceb9cf440fc521f09a503e90889acb7f51b4c39ce8a8c4d37dd8304fca2db4ce
RedLineStealer
f2e2cb71a06ac2a95a02168fc3d91f160e6e07ca19c5e6d3d708a9a486dd3f92
RedLineStealer
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210624-61sq2dl462/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be
MD5 hash:
681a63126f0b9842cc64ffcfdc611e14
SHA1 hash:
3ec551a27ca6a30302779a6e9b7b4100431b393b
Link:
https://www.unpac.me/results/4bd755b1-0bc2-4a78-8539-679f9ca4f882/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be

(this sample)

  
Delivery method
Distributed via web download

Comments