MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f754d7674a3a74969cccb7d834c99b72b9f79c29dc8d0e9c15854a6bfb1a9c97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f754d7674a3a74969cccb7d834c99b72b9f79c29dc8d0e9c15854a6bfb1a9c97
SHA3-384 hash: 98413b56cc4f218d02270b8f26a6d7b877b0fb7f172bf9c7ab19e331c6484195eac801f79562a155ffaab9967cb0c6dd
SHA1 hash: 9dcb0a64e5819f696ab5ebe626142c5295837778
MD5 hash: 915896c351d38fc0c77f69e6ac824465
humanhash: maine-comet-east-hawaii
File name:SECT_v4.ps1
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:800 bytes
First seen:2023-08-01 02:52:33 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 12:i0PsqW2im6KJyX5fZNBbFBCIXduiRxxymL+HqBZYxz7QwcXG2SHq6zVsk/VUgd3d:XrWdbFBCkhyrH8ko1224q6q2x+S
TLSH T1B5011E16208AC3D82CC9C56AB9F5FB8DF418A28650432D15BEF0C6E2B00B0AD8260DA8
Reporter Brad_malware
Tags:powershell PowerShell_script ps1 RedLineStealer Redline_Stealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.68105424.7050.24484.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm powershell
Link:
https://www.filescan.io/uploads/64c87390299c27f4c4f2ac54/reports/de6a75e1-9357-416e-95e5-aab4396bfb29/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f754d7674a3a74969cccb7d834c99b72b9f79c29dc8d0e9c15854a6bfb1a9c97
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1283499
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found suspicious powershell code related to unpacking or dynamic code loading
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f754d7674a3a74969cccb7d834c99b72b9f79c29dc8d0e9c15854a6bfb1a9c97/
Threat name:
Script-PowerShell.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-07-10 15:04:48 UTC
File Type:
Text (PowerShell)
AV detection:
9 of 38 (23.68%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=65knoz2khj2jnhgmw7mdjsm3ok47phbj3sgq5havqvfgx6y2tslq._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230801-dda8jadh9x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://guiatelefonos.com/data/czx.jpg
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f754d7674a3a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f754d7674a3a74969cccb7d834c99b72b9f79c29dc8d0e9c15854a6bfb1a9c97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments