MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff61854c347ac02b4832092f146458fd480edee1a7b09114b754ffbb7a959db8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments 1

SHA256 hash:	ff61854c347ac02b4832092f146458fd480edee1a7b09114b754ffbb7a959db8
SHA3-384 hash:	c2e2cbff01c7983bdf086016cd96f62dc5b5e8a7d00d007a079eb3d341b367f1a481ff1917cd8370087dbbf3fc676968
SHA1 hash:	493fd3b729a7ac500b6196fb4537ea52f7a183ec
MD5 hash:	98aad1f7117ea43141357bff416027f0
humanhash:	west-michigan-venus-july
File name:	98aad1f7117ea43141357bff416027f0
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	215'456 bytes
First seen:	2022-01-17 06:41:14 UTC
Last seen:	2022-01-17 08:45:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	3072:tNpaPUinCj7ffe7tEHDWj6+LvA6ALsLVfAoQvCtYY8RuBbMgmXKmGXNDiKGXNDiT:sIBDkvABsRAoQe1bfHRizRiT
Threatray	4'398 similar samples on MalwareBazaar
TLSH	T1CE24D0A2DA786B54E8E347F052A545228FB2B7737A1CC1695DB5B0DB18B37C24331C2B
File icon (PE):
dhash icon	8ea32b4ba5a64923 (1 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

157

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

98aad1f7117ea43141357bff416027f0

Verdict:

Malicious activity

Analysis date:

2022-01-17 07:13:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e7787e19-5309-494c-a9c7-1b4f6976d9c6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/219711/

Detection(s):

SecuriteInfo.com.Trojan.MulDrop19.23484.5385.5961.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

Sending a custom TCP request

Sending an HTTP GET request

Launching a process

Creating a file

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated overlay packed replace.exe

Link:

https://www.filescan.io/uploads/61e50fbff81da814af88355c/reports/7b420836-98ed-47ce-b72a-56f388076d26/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/65bb0d11-2c47-472d-9dfe-67e4516b5116

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/921564

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff61854c347ac02b4832092f146458fd480edee1a7b09114b754ffbb7a959db8/

Threat name:

ByteCode-MSIL.Trojan.Sabsik

Status:

Malicious

First seen:

2022-01-06 22:32:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

33 of 43 (76.74%)

Threat level:

5/5

Verdict:

malicious

RedLineStealer

07bb36227d8121f29c43baae188b43f3d5c4885ef4b20410fca8985235168c68

RedLineStealer

213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e

RedLineStealer

25cd127b9d559d6754269ecc116d35be66aca027640bcd71a836567c32b946c5

RedLineStealer

772f0c407388e029e98f9d885f57a0e3ef9b0f42099a16fe6367fb321d4e2444

RedLineStealer

f593cd3e0a4ad34d16b48b9cdd344e486b42fbfc5bca0c25abb75b6cc03ac2d0

RedLineStealer

+ 4'388 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/220117-hgcb8ahbap/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Downloads MZ/PE file

Unpacked files

SH256 hash:

56e3d1707c344513b2c9815e3eb335d1ca1fd52e3338596bb03f0d66128b8b09

MD5 hash:

7ba3cbf6527735009a53a1a2575a02b7

SHA1 hash:

b4754006e697dd07d8d51c640f6b220b9f054c17

Link:

https://www.unpac.me/results/80262141-8e13-4d5f-a38c-3f766fdaec46/

SH256 hash:

ff61854c347ac02b4832092f146458fd480edee1a7b09114b754ffbb7a959db8

MD5 hash:

98aad1f7117ea43141357bff416027f0

SHA1 hash:

493fd3b729a7ac500b6196fb4537ea52f7a183ec

Link:

https://www.unpac.me/results/80262141-8e13-4d5f-a38c-3f766fdaec46/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff61854c347ac02b4832092f146458fd480edee1a7b09114b754ffbb7a959db8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/