MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db
SHA3-384 hash:	724519aa7ebc8d9c96de2b7fcfe44bbf98d253a5c90a2869ae6edd2c6495719264fdb367505912ee373de9433c29bcf0
SHA1 hash:	195f95a1cbbbed14e7aa6520e67053fccf4c5b38
MD5 hash:	5a3ef96d751bdbd8eaa53811b297e588
humanhash:	spaghetti-speaker-glucose-magnesium
File name:	system.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	215'040 bytes
First seen:	2023-09-27 07:46:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4777e1ada873b02cb56db354a7f70062 (1 x RedLineStealer)
ssdeep	3072:iVkkzKz9MSSyPv46apKpWH9cGI0Xdb6eyEk3Z2IpzwFgwMSUAzjL9CnfcW:YzMMSdv7eg4yl+6Ak34VF9zLEf
TLSH	T192249F45274B8AD0D82037BD355A9748BA747CB3C05FFC497F82BA887686CDA5D283D8
TrID	32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 20.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	d8c1c4cccec6c8d8 (1 x DCRat, 1 x N-W0rm, 1 x RedLineStealer)
Reporter	r3dbU7z
Tags:	exe Redline RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

449

Origin country :

RU

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

system.exe

Verdict:

Malicious activity

Analysis date:

2023-09-27 07:47:23 UTC

Tags:

redline

Link:

https://app.any.run/tasks/429f6f28-c600-4fec-8514-37866aa49c18

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/451502/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.24075.14829.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

Launching a service

Creating a file

Launching a process

DNS request

Sending a UDP request

Unauthorized injection to a system process

Dragonfly

Gathering data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug packed

Link:

https://www.filescan.io/uploads/6513ddff32ffdb7a7a15c60c/reports/4c004293-dec9-49a8-9166-c8409b8a73ae/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db

Intezer RedLine stealer

Malware family:

RedLine stealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cbf5e740-8002-4b1e-8f10-3eb66980405b

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1315058

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db/

ReversingLabs TitaniumCloud Win32.Spyware.RedLine

Threat name:

Win32.Spyware.RedLine

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-27 07:47:09 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

17 of 23 (73.91%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ajo26r2eew4l4nvj4svo7woc6sbncvrep666gvajb4fdvajnyhnq._file

Threatray unknown

Verdict:

unknown

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline infostealer

Link:

https://tria.ge/reports/230927-jmjh6aac96/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

RedLine

RedLine payload

UnpacMe

Unpacked files

SH256 hash:

025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db

MD5 hash:

5a3ef96d751bdbd8eaa53811b297e588

SHA1 hash:

195f95a1cbbbed14e7aa6520e67053fccf4c5b38

Link:

https://www.unpac.me/results/009f7177-5931-4b1c-98d8-47d4b27446fa/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/025daf474425/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 025daf474425b8be36a9e4aaefd9c2f482d156247fbde354090f0a3a812dc1db

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/451502/