MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03e7020b59dab84deac5d05679ab9869a50856f3a98f7de2a3c1ff6f27929120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	03e7020b59dab84deac5d05679ab9869a50856f3a98f7de2a3c1ff6f27929120
SHA3-384 hash:	ebfff462ff3d4035169bab846d8488d5f3852a79275eff08454b1b9c84d1cf7091a50dbc9a38bc2a0d9dde705c4c54e9
SHA1 hash:	2b0804bd1c3c70db1ea25351578dcad5a276c970
MD5 hash:	f392872c384ee263950a9852648dd3a7
humanhash:	nine-mike-pluto-winner
File name:	f392872c384ee263950a9852648dd3a7
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	363'008 bytes
First seen:	2021-11-10 09:44:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	959e3f7a6ddd7b4ec96854ed6fe13765 (6 x RedLineStealer)
ssdeep	6144:C4VUSCRV470ddSHSAaFqqrcN6MP5/cIFUuzbgwujigaLwVf:C4VUS0V470BfstBxUunnb
Threatray	3'940 similar samples on MalwareBazaar
TLSH	T12174E031B6AC9831E0631E35446186B9063BBC726970918AF750E76E2EB2FDC46F570F
File icon (PE):
dhash icon	fcfcb4d4d4d4d8c0 (70 x RedLineStealer, 59 x RaccoonStealer, 24 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/204666/

Detection(s):

Win.Malware.Fragtor-9907126-0

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/618b94a0dec3347825a11a78/reports/be8947d9-0574-402b-942b-be0703c5d38a/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e64eea7c-9d59-48e7-8464-e0df8d976c7a

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/886596

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03e7020b59dab84deac5d05679ab9869a50856f3a98f7de2a3c1ff6f27929120/

Threat name:

Win32.Trojan.SpywareX

Status:

Malicious

First seen:

2021-11-10 09:45:08 UTC

AV detection:

16 of 45 (35.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aptqec2z3k4e32wf2blhtk4yngsqqvxtvghx3yvdyh7w6j4sseqa._file

Verdict:

malicious

Label(s):

asyncrat

RedLineStealer

2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819de8d468d36f54760f1b

RedLineStealer

6a7af1d145e133bfd37416108227befcfd1c15597f3a05fdf39ec95b9e8f1cfe

RedLineStealer

829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82

RedLineStealer

ca7b59a716d7f6caf24ad2258751b0a3fb8fd174a3c36e44375178500f7714d9

RedLineStealer

d68549067554697569e1566c1e4c993a7e84dae92fb30e39ac9f4fc184e48cd1

RedLineStealer

+ 3'930 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:1132044836 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211110-lq3gjsdhcm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.183.32.184:80

Unpacked files

SH256 hash:

9c6341b148ac2906f5c468d3932d5df78a8e08065a90a3598f3479aa459efed2

MD5 hash:

e622241b33225aae0481873b413fc903

SHA1 hash:

daf8a3224ba1cf5574f7f0136d1ecbbd12e6eb00

Link:

https://www.unpac.me/results/628abe42-9528-4ab0-84c9-5a9dabee496d/

SH256 hash:

dab99fbee62e856c3f80521da9022887a2ae33d824212b6b8154dd441775d2c2

MD5 hash:

0733742afbdf09682d9a02de47ae699b

SHA1 hash:

6902bcd64f4cba3d0f8eff816ab2a2bbeeb916f8

Link:

https://www.unpac.me/results/628abe42-9528-4ab0-84c9-5a9dabee496d/

SH256 hash:

b530575b72400c2e1234035e06f23b71cbda53c846cf66d13eeffaf5b53fc854

MD5 hash:

dde07eaa7dec57b2b69b3bf17c7bbf97

SHA1 hash:

224b8ef1870a054fe22930aa4fd85334017d35d6

Link:

https://www.unpac.me/results/628abe42-9528-4ab0-84c9-5a9dabee496d/

SH256 hash:

03e7020b59dab84deac5d05679ab9869a50856f3a98f7de2a3c1ff6f27929120

MD5 hash:

f392872c384ee263950a9852648dd3a7

SHA1 hash:

2b0804bd1c3c70db1ea25351578dcad5a276c970

Link:

https://www.unpac.me/results/628abe42-9528-4ab0-84c9-5a9dabee496d/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/03e7020b59da/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/03e7020b59dab84deac5d05679ab9869a50856f3a98f7de2a3c1ff6f27929120

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.