MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 18


Intelligence 18 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908
SHA3-384 hash: 51a752347e90826832434c6773a56f102f662374d3f49d7481afe5d176eb65b005e300045f9cee9ee32ede83e5657879
SHA1 hash: 91b31d238075a8fc704999b9010272dd8e3ca8bf
MD5 hash: 7e5b9d33c345c2351e9f2295b617b617
humanhash: summer-earth-ten-moon
File name:7e5b9d33c345c2351e9f2295b617b617.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'133'091 bytes
First seen:2023-06-25 21:30:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash aac51396886833dc961fcd7aab7711e4 (11 x NetSupport, 7 x DCRat, 4 x njrat)
ssdeep 24576:PlMiZMVn1db5ATcLPkZeBEEbHlS9A9Ims+Jpxamu9qWl:i7PkZyg9i6UDpCqWl
Threatray 665 similar samples on MalwareBazaar
TLSH T10F351213F9C08AB2D522183316169F61A13D3D305F758ACBE3D56C5EDE222E0E7367A6
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
85.209.3.4:11285

Intelligence

File Origin
# of uploads :
1
# of downloads :
299
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
7e5b9d33c345c2351e9f2295b617b617.exe
Verdict:
Malicious activity
Analysis date:
2023-06-25 21:32:27 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/ace958e1-e9f8-41e3-84cf-c60668ac66b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Rhadamanthys
Create hunting rule
Link:
https://www.capesandbox.com/analysis/402720/
Detection(s):
Win.Dropper.njRAT-9986242-0
Create hunting rule

Win.Dropper.Nanocore-9986456-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Launching a process
Launching the default Windows debugger (dwwin.exe)
Reading critical registry keys
Unauthorized injection to a system process
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Stealing user critical data
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/92671/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware lolbin overlay packed packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6498b217942dd42877bab96f/reports/ebeb2c9c-ba7e-4d46-8391-8acbad46fc76/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b0eb73f-a25a-4c34-a819-c50f84e9cccc
Result
Threat name:
RHADAMANTHYS, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261147
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected RedLine Stealer
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 894167 Sample: 8z13XclZF6.exe Startdate: 25/06/2023 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 10 other signatures 2->41 8 8z13XclZF6.exe 10 2->8         started        process3 file4 27 C:\Users\user\AppData\Local\Temp\...\ccs.exe, PE32 8->27 dropped 29 C:\Users\user\AppData\Local\Temp\...\cc.exe, PE32 8->29 dropped 11 ccs.exe 1 8->11         started        14 cc.exe 1 8->14         started        process5 dnsIp6 57 Multi AV Scanner detection for dropped file 11->57 59 Machine Learning detection for dropped file 11->59 61 Writes to foreign memory regions 11->61 67 2 other signatures 11->67 17 AppLaunch.exe 5 11->17         started        33 179.43.162.23, 49701, 49703, 8509 PLI-ASCH Panama 14->33 63 Detected unpacking (changes PE section rights) 14->63 65 Detected unpacking (overwrites its own PE header) 14->65 21 certreq.exe 1 14->21         started        23 WerFault.exe 14->23         started        signatures7 process8 dnsIp9 31 rcn.tuktuk.ug 85.209.3.4, 11285, 49702 SQUITTER-NETWORKSNL Russian Federation 17->31 43 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->43 45 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 17->45 47 Tries to harvest and steal browser information (history, passwords, etc) 17->47 49 Tries to steal Crypto Currency Wallets 17->49 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->51 53 Tries to steal Mail credentials (via file / registry access) 21->53 55 Tries to harvest and steal Bitcoin Wallet information 21->55 25 conhost.exe 21->25         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-06-25 21:31:07 UTC
File Type:
PE (Exe)
Extracted files:
206
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=blz2vhtcvzcjgapptm6zszouk524cozpy6tge6k5hfmf2xapveea._file
Verdict:
malicious
Similar samples:
0ca15ac24cd26ecd4afb42b4c8802bcfc1eb06088ae0d3503fbc732f80429531
RedLineStealer
0f13412e34d79c5c24595dbf76c44ded557d8bf22bc420802e7843cc84ef7ded
RedLineStealer
7f500eca61d1bb18feeadebda84d65023a482e7ce11b81184e8357973e63a077
RedLineStealer
97fbb8c62444ab8fef4af17c33117b43c9f926a45445ecc9fc51138089a75000
RedLineStealer
bcc6c5ebaa7ede4e4485cc0a1884e6e12923e4c7aca85283b2a546c2b8034055
RedLineStealer
bd60605304be239c72f53cc7b881a7c0aa77b668f3e732ae1ea032b24e052fc0
RedLineStealer
c459a4a1f1b9253dde6e26e12e651c3990ce4f9d1c464308d360dbaf7f82235f
RedLineStealer
e2160fb0cdb707aa84430207c6357cb9bc099ab4cbbc5299d8be7208a41a718b
RedLineStealer
+ 655 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:redline family:rhadamanthys botnet:240623_rcn_11 collection infostealer spyware stealer
Link:
https://tria.ge/reports/230625-1c14wseg45/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detect rhadamanthys stealer shellcode
RedLine
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
rcn.tuktuk.ug:11285
Unpacked files
SH256 hash:
a13376875d3b492eb818c5629afd3f97883be2a5154fa861e7879d5f770e21d4
MD5 hash:
d0c1a1ed8609b87ba25b771e8144b90c
SHA1 hash:
0da8c2b9e109d97a574f0614550dc2311c331f85
Detections:
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
Parent samples :
bd60605304be239c72f53cc7b881a7c0aa77b668f3e732ae1ea032b24e052fc0
0f13412e34d79c5c24595dbf76c44ded557d8bf22bc420802e7843cc84ef7ded
bcc6c5ebaa7ede4e4485cc0a1884e6e12923e4c7aca85283b2a546c2b8034055
97fbb8c62444ab8fef4af17c33117b43c9f926a45445ecc9fc51138089a75000
695ebf4db6a46967bdecfe41ea5db0b2f96845a460f7d16eb2fcd3111f2dd36c
37e0b7e14eaeeb2205c87261982e272eaa6dd4b95fdd2edc7b2a5b9d29b64a09
ebc9f697284097979e511887e40f9e1bc57fcedb2be1f37fb1ed20ee90004d93
15d2319d94150b66ce714c7bc4f524d52b9154a9a5fc2f336c744a4d56bd77d9
59d09c8a52afad517845498cb8bcef3055f28f3b3d6e673b856f4b488f73149c
6c4c03231ed003e73fd65691c5950ae75f352e8467a486ea3ae34307ba35c297
b5645b317166b0b99f915bd7d5a0de8758c6193c6b6324d4821da47791994595
0ca15ac24cd26ecd4afb42b4c8802bcfc1eb06088ae0d3503fbc732f80429531
7f500eca61d1bb18feeadebda84d65023a482e7ce11b81184e8357973e63a077
ad5fc45f2dd58b5209749b5b5f7aaac5b3413cea80eb200727fa1fd919bb8cf6
c459a4a1f1b9253dde6e26e12e651c3990ce4f9d1c464308d360dbaf7f82235f
c69be220656f8c1b2f425b778bfee586165ab8653b3550e1c8226398429e18a6
1ea3b1f1f09de73b2021a37ef523a55ec13ed673a584e9fd25d80466e806ebf1
c48a7a57d515ae7471b153f2346e0286cdb5707683414d54cb8fa45553ac4087
f72db6936eef06dee9230bb27bfcea84a66773e419807f355bf37fb3f5457947
95bd28472a3dfcffa46dedad1547e5ac3fcad81d35af34a5da524aa380523415
e0a50fbd358e7561e1017edd90a51682f345f6fe8248aa1bf352411ce57d54e3
033bebdf818560c4eba4837b7d7f29a25a0e6876dfa958c4c1dcd8b7665e4f48
c99798d67cbf1e80040257eb9e68f62d966fe53443ca54e120e3a0379152ca80
452c0558713dac55a25f47217368c54ed4d41a97b677c66b4af291cc7f9da862
e3c530a8f37ef3b74788e33c2483ef02b54009a89f981959b0619fab7462afc8
bc1e4e6dd1eec20e8b6685d7e844a0ad045c0700210ef40f451e51dd9fa00910
0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908
81c68d49323f4cc3f1ad6b3634b9a3d0891daed3822c077a3b1a4a6b0b050551
1eb7e20cc13f622bd6834ef333b8c44d22068263b68519a54adc99af5b1e6d34
098c9f426ab6d50a39469ef17adcf10e50b5e91ff9a7594478354098909970df
811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0
SH256 hash:
ebacc4cbda1cb8d2e42f06db213c55541007590e0e217aefeb3061ea7769470f
MD5 hash:
994cc87cf40f7193be03f680f7b41016
SHA1 hash:
8fe828cfd01855140b9cf7c67ea5b214e0cd8023
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
SH256 hash:
579132f09ccee9afb558adf8532670993dd9a2f6c5cb0a8e067f996e5f04c6f5
MD5 hash:
5372f23750d3daae058467195ab902ca
SHA1 hash:
7eaf3c520328eff58a1350084abb0f2250482978
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
SH256 hash:
a13376875d3b492eb818c5629afd3f97883be2a5154fa861e7879d5f770e21d4
MD5 hash:
d0c1a1ed8609b87ba25b771e8144b90c
SHA1 hash:
0da8c2b9e109d97a574f0614550dc2311c331f85
Detections:
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
Parent samples :
bd60605304be239c72f53cc7b881a7c0aa77b668f3e732ae1ea032b24e052fc0
0f13412e34d79c5c24595dbf76c44ded557d8bf22bc420802e7843cc84ef7ded
bcc6c5ebaa7ede4e4485cc0a1884e6e12923e4c7aca85283b2a546c2b8034055
97fbb8c62444ab8fef4af17c33117b43c9f926a45445ecc9fc51138089a75000
695ebf4db6a46967bdecfe41ea5db0b2f96845a460f7d16eb2fcd3111f2dd36c
37e0b7e14eaeeb2205c87261982e272eaa6dd4b95fdd2edc7b2a5b9d29b64a09
ebc9f697284097979e511887e40f9e1bc57fcedb2be1f37fb1ed20ee90004d93
15d2319d94150b66ce714c7bc4f524d52b9154a9a5fc2f336c744a4d56bd77d9
59d09c8a52afad517845498cb8bcef3055f28f3b3d6e673b856f4b488f73149c
6c4c03231ed003e73fd65691c5950ae75f352e8467a486ea3ae34307ba35c297
b5645b317166b0b99f915bd7d5a0de8758c6193c6b6324d4821da47791994595
0ca15ac24cd26ecd4afb42b4c8802bcfc1eb06088ae0d3503fbc732f80429531
7f500eca61d1bb18feeadebda84d65023a482e7ce11b81184e8357973e63a077
ad5fc45f2dd58b5209749b5b5f7aaac5b3413cea80eb200727fa1fd919bb8cf6
c459a4a1f1b9253dde6e26e12e651c3990ce4f9d1c464308d360dbaf7f82235f
c69be220656f8c1b2f425b778bfee586165ab8653b3550e1c8226398429e18a6
1ea3b1f1f09de73b2021a37ef523a55ec13ed673a584e9fd25d80466e806ebf1
c48a7a57d515ae7471b153f2346e0286cdb5707683414d54cb8fa45553ac4087
f72db6936eef06dee9230bb27bfcea84a66773e419807f355bf37fb3f5457947
95bd28472a3dfcffa46dedad1547e5ac3fcad81d35af34a5da524aa380523415
e0a50fbd358e7561e1017edd90a51682f345f6fe8248aa1bf352411ce57d54e3
033bebdf818560c4eba4837b7d7f29a25a0e6876dfa958c4c1dcd8b7665e4f48
c99798d67cbf1e80040257eb9e68f62d966fe53443ca54e120e3a0379152ca80
452c0558713dac55a25f47217368c54ed4d41a97b677c66b4af291cc7f9da862
e3c530a8f37ef3b74788e33c2483ef02b54009a89f981959b0619fab7462afc8
bc1e4e6dd1eec20e8b6685d7e844a0ad045c0700210ef40f451e51dd9fa00910
0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908
81c68d49323f4cc3f1ad6b3634b9a3d0891daed3822c077a3b1a4a6b0b050551
1eb7e20cc13f622bd6834ef333b8c44d22068263b68519a54adc99af5b1e6d34
098c9f426ab6d50a39469ef17adcf10e50b5e91ff9a7594478354098909970df
811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0
SH256 hash:
ebacc4cbda1cb8d2e42f06db213c55541007590e0e217aefeb3061ea7769470f
MD5 hash:
994cc87cf40f7193be03f680f7b41016
SHA1 hash:
8fe828cfd01855140b9cf7c67ea5b214e0cd8023
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
SH256 hash:
579132f09ccee9afb558adf8532670993dd9a2f6c5cb0a8e067f996e5f04c6f5
MD5 hash:
5372f23750d3daae058467195ab902ca
SHA1 hash:
7eaf3c520328eff58a1350084abb0f2250482978
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
SH256 hash:
a13376875d3b492eb818c5629afd3f97883be2a5154fa861e7879d5f770e21d4
MD5 hash:
d0c1a1ed8609b87ba25b771e8144b90c
SHA1 hash:
0da8c2b9e109d97a574f0614550dc2311c331f85
Detections:
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
Parent samples :
bd60605304be239c72f53cc7b881a7c0aa77b668f3e732ae1ea032b24e052fc0
0f13412e34d79c5c24595dbf76c44ded557d8bf22bc420802e7843cc84ef7ded
bcc6c5ebaa7ede4e4485cc0a1884e6e12923e4c7aca85283b2a546c2b8034055
97fbb8c62444ab8fef4af17c33117b43c9f926a45445ecc9fc51138089a75000
695ebf4db6a46967bdecfe41ea5db0b2f96845a460f7d16eb2fcd3111f2dd36c
37e0b7e14eaeeb2205c87261982e272eaa6dd4b95fdd2edc7b2a5b9d29b64a09
ebc9f697284097979e511887e40f9e1bc57fcedb2be1f37fb1ed20ee90004d93
15d2319d94150b66ce714c7bc4f524d52b9154a9a5fc2f336c744a4d56bd77d9
59d09c8a52afad517845498cb8bcef3055f28f3b3d6e673b856f4b488f73149c
6c4c03231ed003e73fd65691c5950ae75f352e8467a486ea3ae34307ba35c297
b5645b317166b0b99f915bd7d5a0de8758c6193c6b6324d4821da47791994595
0ca15ac24cd26ecd4afb42b4c8802bcfc1eb06088ae0d3503fbc732f80429531
7f500eca61d1bb18feeadebda84d65023a482e7ce11b81184e8357973e63a077
ad5fc45f2dd58b5209749b5b5f7aaac5b3413cea80eb200727fa1fd919bb8cf6
c459a4a1f1b9253dde6e26e12e651c3990ce4f9d1c464308d360dbaf7f82235f
c69be220656f8c1b2f425b778bfee586165ab8653b3550e1c8226398429e18a6
1ea3b1f1f09de73b2021a37ef523a55ec13ed673a584e9fd25d80466e806ebf1
c48a7a57d515ae7471b153f2346e0286cdb5707683414d54cb8fa45553ac4087
f72db6936eef06dee9230bb27bfcea84a66773e419807f355bf37fb3f5457947
95bd28472a3dfcffa46dedad1547e5ac3fcad81d35af34a5da524aa380523415
e0a50fbd358e7561e1017edd90a51682f345f6fe8248aa1bf352411ce57d54e3
033bebdf818560c4eba4837b7d7f29a25a0e6876dfa958c4c1dcd8b7665e4f48
c99798d67cbf1e80040257eb9e68f62d966fe53443ca54e120e3a0379152ca80
452c0558713dac55a25f47217368c54ed4d41a97b677c66b4af291cc7f9da862
e3c530a8f37ef3b74788e33c2483ef02b54009a89f981959b0619fab7462afc8
bc1e4e6dd1eec20e8b6685d7e844a0ad045c0700210ef40f451e51dd9fa00910
0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908
81c68d49323f4cc3f1ad6b3634b9a3d0891daed3822c077a3b1a4a6b0b050551
1eb7e20cc13f622bd6834ef333b8c44d22068263b68519a54adc99af5b1e6d34
098c9f426ab6d50a39469ef17adcf10e50b5e91ff9a7594478354098909970df
811dec9ec1252218598615343fe2e04a62a296e3f156778c4d168b4eec8a0bf0
SH256 hash:
ebacc4cbda1cb8d2e42f06db213c55541007590e0e217aefeb3061ea7769470f
MD5 hash:
994cc87cf40f7193be03f680f7b41016
SHA1 hash:
8fe828cfd01855140b9cf7c67ea5b214e0cd8023
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
SH256 hash:
579132f09ccee9afb558adf8532670993dd9a2f6c5cb0a8e067f996e5f04c6f5
MD5 hash:
5372f23750d3daae058467195ab902ca
SHA1 hash:
7eaf3c520328eff58a1350084abb0f2250482978
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
SH256 hash:
0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908
MD5 hash:
7e5b9d33c345c2351e9f2295b617b617
SHA1 hash:
91b31d238075a8fc704999b9010272dd8e3ca8bf
Link:
https://www.unpac.me/results/dcb571c5-a25d-4ca1-854b-01ce516de302/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0af3aa9e62ae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BruteSyscallHashes
Create hunting rule
Author:Embee_Research @ Huntress
Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer_2
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_brute_ratel_c4_w0
Create hunting rule
Author:Embee_Research @ Huntress
Rule name:win_Brute_Syscall_Hashes
Create hunting rule
Author:Embee_Research @ Huntress
Description:Detection of Brute Ratel Badger via api hashes of Nt* functions.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 0af3aa9e62ae449301ef9b3d9965d45775c13b2fc7a662795d39585d5c0fa908

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2660612/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/402720/

Comments