MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0775e8cd43f856f12da4aa77fcef506b45c1da669bd37a93ddcb1a1a1f1d4aa3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 18
| SHA256 hash: | 0775e8cd43f856f12da4aa77fcef506b45c1da669bd37a93ddcb1a1a1f1d4aa3 |
|---|---|
| SHA3-384 hash: | cbbe6d41507650d4becb439bb2c46670346d0caccb95509a76431e165ebbc8c4fa5f86f2fe33843ee9738e01b6bab22d |
| SHA1 hash: | 543f4c3d3fde073917bb0a930bfca91ac84b20cd |
| MD5 hash: | 8c2df7e94aecf922bac33303693edc40 |
| humanhash: | football-london-network-yellow |
| File name: | SecuriteInfo.com.Trojan.PWS.Stealer.38294.10376.15724 |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 2'735'184 bytes |
| First seen: | 2025-04-24 17:17:32 UTC |
| Last seen: | 2025-04-24 18:17:17 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b1c5b1beabd90d9fdabd1df0779ea832 (11 x CoinMiner, 10 x QuasarRAT, 8 x AsyncRAT) |
| ssdeep | 49152:kDjlabwz922E1G8hl3INPHfdBcZiyuNFBAkpVOZgyo2upnA4yOQC2:0qwE2E1G4ONHdBcMyuNFBAkHOZNoBA4m |
| Threatray | 303 similar samples on MalwareBazaar |
| TLSH | T168C5120AE7E404F8E1B7F63889268916F77B3C5A4771968F12AD121A1F77390CD3A721 |
| TrID | 92.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10522/11/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.7% (.EXE) OS/2 Executable (generic) (2029/13) 0.6% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| dhash icon | 9494b494d4aeaeac (917 x DCRat, 486 x NirCmd, 172 x RedLineStealer) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
553
Origin country :
FRVendor Threat Intelligence
Malware family:
amadey
ID:
1
File name:
2025-04-20_112ad3ad7493add4fd3a3b8435acd577_agent-tesla_black-basta_cobalt-strike_elex_luca-stealer
Verdict:
Malicious activity
Analysis date:
2025-04-20 12:56:21 UTC
Tags:
loader auto-sch amadey botnet stealer lumma rdp auto-reg themida credentialflusher gcleaner auto generic phishing github darkvision remote pastebin fileshare auto-startup autoit python miner redline metastealer telegram rhadamanthys inno installer delphi
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CoinMiner02
Verdict:
Malicious
Score:
96.5%
Tags:
redline autorun
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Running batch commands
Launching the process to interact with network services
Launching a process
Creating a file
Creating a file in the %AppData% subdirectories
Launching cmd.exe command interpreter
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Creating a service
Launching a service
Loading a system driver
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun for a service
Stealing user critical data
Enabling autorun by creating a file
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-vm fingerprint microsoft_visual_cc overlay overlay packed packer_detected
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Malware family:
XMRig Miner
Verdict:
Malicious
Result
Threat name:
RedLine, Xmrig
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Xmrig
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Score:
94%
Verdict:
Malware
File Type:
PE
Threat name:
Win64.Trojan.Vigorf
Status:
Malicious
First seen:
2025-04-20 12:14:52 UTC
File Type:
PE+ (Exe)
Extracted files:
37
AV detection:
17 of 24 (70.83%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
redlinestealer
Similar samples:
+ 293 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:redline family:xmrig botnet:cheat discovery execution infostealer miner spyware stealer
Behaviour
Delays execution with timeout.exe
Runs net.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
RedLine
RedLine payload
Redline family
XMRig Miner payload
Xmrig family
xmrig
Malware Config
C2 Extraction:
193.233.237.109:1912
Verdict:
Malicious
Tags:
stealer metastealer c2 redline
YARA:
n/a
Unpacked files
SH256 hash:
0775e8cd43f856f12da4aa77fcef506b45c1da669bd37a93ddcb1a1a1f1d4aa3
MD5 hash:
8c2df7e94aecf922bac33303693edc40
SHA1 hash:
543f4c3d3fde073917bb0a930bfca91ac84b20cd
SH256 hash:
c655dd671aeb2ff28f0a0fc53d8aa0f48d4a8168b8bfc5de14ab10399ed088f8
MD5 hash:
b0f3492b4fbfb6500bfaeba5a66de632
SHA1 hash:
6d33c2c1190997c4567fcad3aea15e64c15423e9
Detections:
XMRig
MAL_XMR_Miner_May19_1
XMRIG_Monero_Miner
MALWARE_Win_CoinMiner02
SH256 hash:
e39ed20a21059612613bf65ddb48f9b7e2a91e598ae84900c0611972b24c6d07
MD5 hash:
63a32242ef09abfc8528a6e3eb5b7497
SHA1 hash:
21f9b816792cd900ffad3aa84e097a0a865ffd72
Detections:
redline
MALWARE_Win_MetaStealer
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SelfExtractingRAR |
|---|---|
| Author: | Xavier Mertens |
| Description: | Detects an SFX archive with automatic script execution |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (FORCE_INTEGRITY) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| GDI_PLUS_API | Interfaces with Graphics | gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipAlloc |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.