MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 3 File information Comments

SHA256 hash:	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1
SHA3-384 hash:	0b3847cfae150cd5615aa7893d596bc7ccaed81a0c673100dd9e3127e45179a3dc06d84a2819706509b861947be39682
SHA1 hash:	9428c1e4109c62f71fa850469a2f4374f09574f1
MD5 hash:	93aba80ef8c7ce6282497c48e7e7ccd8
humanhash:	montana-oven-wyoming-gee
File name:	receipt -_-Swift-pdf.tar.lz.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	344'064 bytes
First seen:	2023-09-28 06:08:11 UTC
Last seen:	2023-09-28 06:30:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bf5a4aa99e5b160f8521cadd6bfe73b8 (432 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep	3072:lDKW1LgppLRHMY0TBfJvjcTp5XZonONL1Y111111405kKjdYz6m1hKbe:lDKW1Lgbdl0TBBvjc/ZogLXax27ib
TLSH	T1CF7482F871E1E27AC81582301D65BD7147F51CA0CE71A956EDDCF9E4DA30EF22B2224A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	10808a8c8c8a8010 (77 x Formbook, 51 x AgentTesla, 44 x RemcosRAT)
Reporter	cocaman
Tags:	exe payment RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

316

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

receipt -_-Swift-pdf.tar.lz.exe

Verdict:

Malicious activity

Analysis date:

2023-09-28 08:37:37 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b2b592bd-0431-441f-90c5-d81ddebe1e0e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/451723/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Creating a window

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control greyware lolbin masquerade net_reactor packed

Link:

https://www.filescan.io/uploads/6515187f0870810f01883840/reports/f0ad42a3-bd5f-4798-9a38-a9443b469159/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e41f8317-a7e9-474b-b577-bca8cbb25d7a

Result

Threat name:

AgentTesla, RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1315669

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2023-09-27 10:18:19 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 38 (65.79%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6t56irqbsshci5hlwnjgdfjlbd6pkgrltdhxt3ake76ttpngkhyq._file

Verdict:

malicious

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230928-gwfshshg48/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Unpacked files

SH256 hash:

9f4e3cd1625a49c82bce9e2661a485c7bbf5361cd4480da4abe11338e58e9e18

MD5 hash:

99a36987bb361fb4959f88cb0e6bc560

SHA1 hash:

fe0149ded4c8bfac4418a37942478cf2dbf52ebe

Link:

https://www.unpac.me/results/edd9639b-dcab-4511-9668-b09fc68732a1/

SH256 hash:

44e9878877ca3b5a55bd10c159f8b2bd3aa997671d0d3b4eec48c6a45d5a273b

MD5 hash:

a402cdb6e87f2146d4697283b1b35cb7

SHA1 hash:

72e0e6f50ca811ad629775c3b16e0b21e31e369a

Link:

https://www.unpac.me/results/edd9639b-dcab-4511-9668-b09fc68732a1/

SH256 hash:

f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1

MD5 hash:

93aba80ef8c7ce6282497c48e7e7ccd8

SHA1 hash:

9428c1e4109c62f71fa850469a2f4374f09574f1

Link:

https://www.unpac.me/results/edd9639b-dcab-4511-9668-b09fc68732a1/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f4fbe4460194/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/