MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c987c8fe2921c128530d7019f68c1baf36b8bb78a468649acb546f98246f7f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	0c987c8fe2921c128530d7019f68c1baf36b8bb78a468649acb546f98246f7f9
SHA3-384 hash:	37ed8ef314a568971e438d15d1d7d0af41ae08f35d550be3c4e773336fc15d594838e201462cdae47332a18da2a687d3
SHA1 hash:	424004e132fa355bd403f103f89484c0964ea915
MD5 hash:	a34cab5cffba1d5b84e935cf275681a7
humanhash:	bluebird-violet-oregon-juliet
File name:	a34cab5cffba1d5b84e935cf275681a7.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	417'280 bytes
First seen:	2021-12-10 08:13:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c50981c3cb3d1a5776b7d51392f3f197 (1 x ArkeiStealer, 1 x RedLineStealer, 1 x RaccoonStealer)
ssdeep	6144:KoNw0nNbsvhCpWyjtOPGDbagBLCd5g1TOaRcjfeWnLlDP9Z395e:pw44vIcyjt9/xBed5g1iaRWfe8RP9Pg
Threatray	4'224 similar samples on MalwareBazaar
TLSH	T18694CF04B7A0C035F1B702F44D79D3A9A93E7EB1A72494CF62D12AEA5A756E0DC3134B
File icon (PE):
dhash icon	b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a34cab5cffba1d5b84e935cf275681a7.exe

Verdict:

Suspicious activity

Analysis date:

2021-12-10 08:16:16 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/59cfd393-7466-4063-b7bd-ab22aef88d3b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/213068/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1499/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61b30c4d4d8e6f3a5e1eb2cc/reports/9f6ca208-65d1-40be-85e8-dc56c8e7dcc9/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/10e3a536-2794-4b1b-b851-852f48c38620

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/905166

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c987c8fe2921c128530d7019f68c1baf36b8bb78a468649acb546f98246f7f9/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-12-10 08:14:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bsmhzd7csiobfbjq24az62gbxlzwxc5xrjdimsnmwvdptasg674q._file

Verdict:

malicious

RedLineStealer

5a68552297b1a15eb91df368e34aff338f266f188d853f83ce800c7de7fdaa48

RedLineStealer

88c12eb802c422278c5c7b48fc62e3a79d7a34710d338a3d7682525a4eec4fc4

RedLineStealer

c0166e944a7c2577c74350efa20721ee13b4915d2a1f0443b78e3d877781542f

RedLineStealer

c197f595bd86e292190aaae362cd13b9e51654154ec35c496d263526225276df

RedLineStealer

cca02eaba0809751d81481ee4db3631ff546054d7ebb11d5099f58ca91dbadd2

RedLineStealer

+ 4'214 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:ruzki infostealer

Link:

https://tria.ge/reports/211210-j4z78shbdj/

Behaviour

Suspicious use of AdjustPrivilegeToken

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.215.113.29:26828

Unpacked files

SH256 hash:

e648726cd67210ec43545fc65a8a91239d1581ec47e8128516750b151e88e721

MD5 hash:

c6e5e726d9717692a410d3ec9235968f

SHA1 hash:

f16dddc35fc33525c387e139c3c2c332aa251768

Link:

https://www.unpac.me/results/a8d2ee4f-bde4-462d-b978-b55765d69139/

SH256 hash:

145c34977e13209fd073394e4ec49c62d46afedc172b4218d17439b4b6e92fb3

MD5 hash:

43063526e1d2d20bf698ba80c215a9a4

SHA1 hash:

30ec1948d03cb77feddfa8febc0b1b0ae869e21c

Link:

https://www.unpac.me/results/a8d2ee4f-bde4-462d-b978-b55765d69139/

SH256 hash:

61cf6e45c6a5f9dca0476fbe08d9ce3e094b611d5c353e6c44e046be8bb77a14

MD5 hash:

04fbcd6415208bb9029fa07965aa4943

SHA1 hash:

2f5685d2d62181046ac43a3c281129535c23f823

Link:

https://www.unpac.me/results/a8d2ee4f-bde4-462d-b978-b55765d69139/

SH256 hash:

0c987c8fe2921c128530d7019f68c1baf36b8bb78a468649acb546f98246f7f9

MD5 hash:

a34cab5cffba1d5b84e935cf275681a7

SHA1 hash:

424004e132fa355bd403f103f89484c0964ea915

Link:

https://www.unpac.me/results/a8d2ee4f-bde4-462d-b978-b55765d69139/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c987c8fe2921c128530d7019f68c1baf36b8bb78a468649acb546f98246f7f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.