MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0391c19b8a51e02dd9eaec586aade639a1cfdc0b0ad70752f7995fe26f8bec8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments

SHA256 hash:	0391c19b8a51e02dd9eaec586aade639a1cfdc0b0ad70752f7995fe26f8bec8a
SHA3-384 hash:	17beee4621d16a257d159738c886e6c83e31dda2d62a87ab6a7bd957b51c92200503105246887ec6ea1537553daedab3
SHA1 hash:	ae2df1a99647571e639899aeae8ca89f51f459af
MD5 hash:	66086f7f02cb1f2cfb31eaefb66cdac9
humanhash:	thirteen-november-delaware-fruit
File name:	66086f7f02cb1f2cfb31eaefb66cdac9.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	414'208 bytes
First seen:	2022-05-24 19:37:53 UTC
Last seen:	2022-05-24 20:46:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	34ff7e20707a95b4b7d5e47ec7c583fd (7 x RedLineStealer, 2 x Smoke Loader)
ssdeep	6144:0kCh7cK7BGHZoddiQNA18C+XG8/ZVjc20RpigavwVf:0HcK7Bn618C+3ZFwRM
TLSH	T1FF94E041B6A0DC71E0631E308839EBA55B3BFD3268719507FB50671EAE7338292B2757
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	d8a432f0d8623694 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
193.106.191.222:23196

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.106.191.222:23196	https://threatfox.abuse.ch/ioc/629536/

Intelligence

File Origin

# of uploads :

# of downloads :

314

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

socelars

ID:

File name:

File.exe

Verdict:

Malicious activity

Analysis date:

2022-05-24 19:36:49 UTC

Tags:

evasion trojan socelars stealer loader opendir rat redline amadey ransomware stop

Link:

https://app.any.run/tasks/1c1f30c9-62ae-419f-84ee-e2b08f3186ad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/274274/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/19925/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/628d3457054dcf0ecae8e7b3/reports/38c90cee-7cf1-499f-b011-feba50915a33/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3c499042-3865-44c4-93fa-17604c8c5d94

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1001010

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0391c19b8a51e02dd9eaec586aade639a1cfdc0b0ad70752f7995fe26f8bec8a/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-05-24 19:38:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aoi4dg4kkhqc3wpk5rmgvlpghgq47xalbllqouxxtfp6e34l5sfa._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:mta discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220524-ycc1ysehh3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Malware Config

C2 Extraction:

193.106.191.222:23196

Unpacked files

SH256 hash:

043caecd0ee6f9c4d6c9daac055d859aa2d3b7465cb21b5ed3fdfb284c9748af

MD5 hash:

6db206fc081f47b3c3ed987e5679a61b

SHA1 hash:

9fc9fa72a17c953befeda382db06dd47451cb963

Link:

https://www.unpac.me/results/d74838af-dc66-4b78-9d55-15b16ce59a63/

SH256 hash:

638c078e793069dc67e572483091c2eb7816a341ed9f049b0e15b9573e6969d5

MD5 hash:

a611f4ca2a94fd49981b39478348cb6b

SHA1 hash:

5462432972f1e9a8c5b22e69ad3d9a0142a4096c

Link:

https://www.unpac.me/results/d74838af-dc66-4b78-9d55-15b16ce59a63/

SH256 hash:

56837e7a3ab1fe185c4f82fd170d64b7d9c3fe6062f0820cbaff7afe0098e676

MD5 hash:

c48a6be19618149b334812aa11d0bd4a

SHA1 hash:

4e708b4b369285d9d0e6143f511207359dd658fd

Link:

https://www.unpac.me/results/d74838af-dc66-4b78-9d55-15b16ce59a63/

SH256 hash:

0391c19b8a51e02dd9eaec586aade639a1cfdc0b0ad70752f7995fe26f8bec8a

MD5 hash:

66086f7f02cb1f2cfb31eaefb66cdac9

SHA1 hash:

ae2df1a99647571e639899aeae8ca89f51f459af

Link:

https://www.unpac.me/results/d74838af-dc66-4b78-9d55-15b16ce59a63/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0391c19b8a51/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0391c19b8a51e02dd9eaec586aade639a1cfdc0b0ad70752f7995fe26f8bec8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.