MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939
SHA3-384 hash: d72440c7e672fd0066872dcd31c674f89d3b3b3be303245624d093edffe30c5bba7152caa973e947a3807dfee32780ae
SHA1 hash: 2552ea09d897f43eebcfe16948e113ca63fb375f
MD5 hash: 43eec34ab63b90f072b462512c3223d5
humanhash: north-artist-fillet-happy
File name:43eec34ab63b90f072b462512c3223d5
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'724'864 bytes
First seen:2021-06-27 23:00:04 UTC
Last seen:2021-06-27 23:42:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 49152:jFSnRoQcMDVJeGA5x/xQC2Bp48SWeWZMxs7UXUmQlZrk:jFSnRoQcoaYeTx8Zmkpk
Threatray 17 similar samples on MalwareBazaar
TLSH 53C56C12B654DE02C06D2637D9CF401487FCED227A76EA2A7F8A335D62573A75C0A1CE
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
43eec34ab63b90f072b462512c3223d5
Verdict:
Malicious activity
Analysis date:
2021-06-27 23:02:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5d4e80b9-1181-4abd-b3d7-f227f3425a9b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168504/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.19724.14258.12196.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/74ce6abe-3621-4436-9625-9f21aae7ca39
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/808628
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441039 Sample: xTp0Shx9CV Startdate: 28/06/2021 Architecture: WINDOWS Score: 56 26 Multi AV Scanner detection for submitted file 2->26 28 Machine Learning detection for sample 2->28 7 xTp0Shx9CV.exe 14 3 2->7         started        11 xTp0Shx9CV.exe 1 2->11         started        14 xTp0Shx9CV.exe 2->14         started        16 xTp0Shx9CV.exe 2->16         started        process3 dnsIp4 24 176.111.174.107, 49716, 80 WILWAWPL Russian Federation 7->24 30 Uses schtasks.exe or at.exe to add and modify task schedules 7->30 18 schtasks.exe 1 7->18         started        22 C:\Users\user\AppData\...\xTp0Shx9CV.exe.log, ASCII 11->22 dropped file5 signatures6 process7 process8 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2021-06-27 19:08:00 UTC
AV detection:
7 of 28 (25.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1c0eb090ad769cdd943476e9300d57e553ad24f099408334b8c0370ee9bb7648
RedLineStealer
200b64a2d1d30811d3feae4a361bd652104ecc7ac98c7c4804f0bbf2bb47028e
RedLineStealer
47f55d901f3a0fcc649afa6e44bd4307fffd877ac92a33fde21992a93e54b27d
RedLineStealer
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
RedLineStealer
79afc9b39ba7fe7dd6ed282d39eb915bb47271d552177f62c6606b99901f9cd2
RedLineStealer
95f5464f22e6bbe285c912f7afd00836c7253babdf6b608cbbb5a063bb1f868f
RedLineStealer
9a693191c99ec28e49e610cd89af5137fb077ad8b4d7452828dbabd055e65384
RedLineStealer
9dd91a17703dba0d4582e24431c17eac4fdca602ea8d14f4f43afcc2657b3bbc
RedLineStealer
ed190afc14d4389527347867538df5949d132ce9d5da7c323e8812b08c0242be
RedLineStealer
f2e2cb71a06ac2a95a02168fc3d91f160e6e07ca19c5e6d3d708a9a486dd3f92
RedLineStealer
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210627-dy8spclxqx/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939
MD5 hash:
43eec34ab63b90f072b462512c3223d5
SHA1 hash:
2552ea09d897f43eebcfe16948e113ca63fb375f
Link:
https://www.unpac.me/results/4e0f1a50-84a4-4212-9fc3-ebcd70fe130b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe faabfe5dfc64dc288ba532a14ad6416afc8c81418ccbf2411760bf25f91d6939

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/168504/

Comments