MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02989f6664dd6098efe0d9717187cd57fd2ab9d7c1fc9fd8d49817aa81d80caa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs 1 YARA 1 File information Comments

SHA256 hash:	02989f6664dd6098efe0d9717187cd57fd2ab9d7c1fc9fd8d49817aa81d80caa
SHA3-384 hash:	69d26be1fb047d26106943427747acdb5ef21560947c8c71eb444311846e30bf71bc1c14995b1405a4d7fc63ec9f9b97
SHA1 hash:	07c96d4348f195664d7cc90e575d2496c5c43389
MD5 hash:	0f4351c43a09cb581dc01fe0ec08ff83
humanhash:	carpet-snake-seventeen-autumn
File name:	0f4351c43a09cb581dc01fe0ec08ff83.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'628'576 bytes
First seen:	2022-07-08 19:55:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e379f66a7187b91750d7802534777d71 (3 x RedLineStealer, 1 x ArkeiStealer)
ssdeep	49152:5eGG92Qu/Asv5DLQwGWkzOaL3J3ZoIowFSbA4h/KKt5:c92ZxiykzO45yIowyxF7
TLSH	T1FF7512513D818692FB0956301478EB34A43DBCD5B833D21F2D76F3D99FBDB01A62A42A
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f0f4b2b0b2f2d0cc (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer signed

Code Signing Certificate

Organisation:	techhive.com
Issuer:	R3
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-05-23T12:53:46Z
Valid to:	2022-08-21T12:53:45Z
Serial number:	03af2650f7de2b156ff933c70ecea51b575d
Intelligence:	5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	54e60707c6fa81c38f260f7494911bd3b5ea2f4e2f7bbc9ebf7ab65469acd076
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

abuse_ch

RedLineStealer C2:
185.17.0.63:34397

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.17.0.63:34397	https://threatfox.abuse.ch/ioc/817264/

Intelligence

File Origin

# of uploads :

# of downloads :

420

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/285713/

Detection(s):

SecuriteInfo.com.Artemis0F4351C43A09.30938.8107.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Launching a process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/62c88c1011764e36f8240f00/reports/80ee03e8-dd5e-4989-a699-a9cb517b0d0c/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/8fc4c799-c6de-4236-90e3-2db459ee85da

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1027547

Signature

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/02989f6664dd6098efe0d9717187cd57fd2ab9d7c1fc9fd8d49817aa81d80caa/

Threat name:

Win32.Trojan.Woreflint

Status:

Malicious

First seen:

2022-07-08 19:56:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=akmj6zte3vqjr37a3fyxdb6nk76svooxyh6j7wgutal2vaoybsva._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:def infostealer spyware

Link:

https://tria.ge/reports/220708-ynnxlaefdq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

RedLine payload

Malware Config

C2 Extraction:

185.17.0.63:34397

Unpacked files

SH256 hash:

8816aa8badfdd08c37776fdff6f542bf790ddc1e9d5d5e92757ea755f08d550d

MD5 hash:

6740f60ce767bde8fe0b68e6a30452dc

SHA1 hash:

41467f15de57321e64a96f640d1240a50703ad79

Link:

https://www.unpac.me/results/dfbef938-2fe8-4eb0-966d-d428cf7c762d/

SH256 hash:

cd6d2591ba51033d97a274defa92698bd7ddfd822ad94a041c34b8378efc4654

MD5 hash:

586aac01ef090b1bd094a92a0147c339

SHA1 hash:

58c24979b7d1de14f9e53ff4696458bf8080acde

Link:

https://www.unpac.me/results/dfbef938-2fe8-4eb0-966d-d428cf7c762d/

SH256 hash:

02989f6664dd6098efe0d9717187cd57fd2ab9d7c1fc9fd8d49817aa81d80caa

MD5 hash:

0f4351c43a09cb581dc01fe0ec08ff83

SHA1 hash:

07c96d4348f195664d7cc90e575d2496c5c43389

Link:

https://www.unpac.me/results/dfbef938-2fe8-4eb0-966d-d428cf7c762d/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/02989f6664dd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/02989f6664dd6098efe0d9717187cd57fd2ab9d7c1fc9fd8d49817aa81d80caa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.