MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19
SHA3-384 hash: b500f651e1bc81f50fb6bec1c9b60255f1fa19920d19494b3dbf5cd788aed8e2f1bd3022e62d9644ac67a59b16da84fb
SHA1 hash: 5c0e629984f5720e57e137abc4125da70b224097
MD5 hash: 7a780fbbb30ed7f241d5c9dccd10b065
humanhash: emma-fruit-lake-magazine
File name:7a780fbbb30ed7f241d5c9dccd10b065
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:420'352 bytes
First seen:2023-07-18 15:49:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f46cd2f6fa2b68be3021a7a4bfd8efb (2 x RedLineStealer, 1 x Smoke Loader, 1 x Tofsee)
ssdeep 6144:5qfLNuSxCYYJ3Ol+98k7j/RQr2TI7u/RS4s6T:UfBuS1X46kqh7gTf
Threatray 234 similar samples on MalwareBazaar
TLSH T1D394F84392A1BD44E9258B729E1FC3FC770DF6508E8E7B6A6119AE1F00B11B6E1B3714
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 00082c480e030600 (1 x RedLineStealer, 1 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
7a780fbbb30ed7f241d5c9dccd10b065
Verdict:
Malicious activity
Analysis date:
2023-07-18 15:50:33 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/4df2b423-baf3-4084-9d8b-5c18c3e91561

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/423961/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64b6b4adfd9e198dc115be08/reports/18082097-f0be-4891-8f51-395d1d0d6c34/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/59810b02-6ea4-41de-a1d0-2f03ebf09d16
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1275276
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
redline
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-07-18 15:50:07 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bt2zclqb2yo3fbp3ag33aslrcf725bqstjmdztudv3suqluejqmq._file
Verdict:
malicious
Similar samples:
00fc3bba8814fea6dd4c9b78ae51876f5e6a213ca7919451253008330160aba2
RedLineStealer
17b06b8cdf3b99754409988f579971fa396ad1807570143818ef5c0c532dd86d
RedLineStealer
36613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6
RedLineStealer
54347c92b3f40ffb6e06b6c2491094dd9a35c84a2eeb09ec15e20ba0b69e1cd5
RedLineStealer
62a2221333631de6cf65db3fa3e2650947b23f24ea172a3ea998d77baa0cb270
RedLineStealer
e54412bc24512c26b03a502256ba54730489e38d5a18adaf594dd8f5efc9665d
RedLineStealer
ebb2ba69aefa29443238a76949a991384b01e4bb8291cfc5531e233d448cb280
RedLineStealer
+ 224 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@germany discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230718-s9xtqscf5s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
194.26.135.162:2920
Unpacked files
SH256 hash:
bf0c40ace850af22ed499c3b0504249f65d43d24479a52a92ed0995b58513c15
MD5 hash:
f4068130a33c503eecbe9f9dd27f4237
SHA1 hash:
c796ac46069d75b6858c30c4178dcdfd470b4122
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/736212f4-820b-4d40-9a6a-e0fcbe290131/
Parent samples :
54347c92b3f40ffb6e06b6c2491094dd9a35c84a2eeb09ec15e20ba0b69e1cd5
0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19
4b821e183fd57320849d7999495a583e0a74ee4bcffd59daefae37534f736393
25223dcb5c58948525d07a527f3d60b9ac1d5066f158ca0dd9cfcdde0570f9ed
116b4fa2541f40e452d7aa04de03095d97a8fcb5d2f118ec60b112e228d42062
27939e0c5b1fe6f52d27e4bc1fa21b9e20837e0aa4a7d6a12a8564fcc8928106
dcbfe3857cc6ba5394a223008422349ca296cc676f7f60618b0b3cc67f7a5597
df282ea63eecaa2e3e46c39748f5a2be5e885cdcf0d857258b13957808ecdb52
da29c485d19eaa1e567d555db19a7bb5a5e74df17be79f7817a42c0cca1566ff
f5e4e57c0c6b27846676f07828e2dc02837f03f83da2471701fbadea52fd742c
1f8f52ad901f6f1f77494997aeb7c94c4e8f6c031a170a92cf1d1eac5ef4a0bd
883e13b0ee3b095b37bf146fa5d4f0dc428bb68daca717e98f28c769cde5c7dd
09e1d06be43c59027f2315088f1c53cca84aae43489f9639f907de6e327d9628
718034f9b541fdf7866851cd4ced6b406e07952944717e4291b38e75ac763e12
febd6964bdd7f4d619fa5b9fa4cab9664544370704d3cf04976eb8c520825c2e
680fa23ffd5f8185eb50f54932becc71d2d3b51b39033f853c4ea2e8737e34f0
b824349984caaa7351d0c62a0b04e0ff3412834c24e7f9f29e9c1459c525ccb1
6dda6c6e5f927c449bb2e3748eaa9329aab3c6c3f9f54bbdaf8f49d33f844a56
399139bc23966f9509eb7bcc58f880e52df62c293f800d704bff96e0b0e8d09f
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8
ee5754e39b22b6758e5d2b940a0cfc11835a80779073148028a6222a7e37e086
9fc1d2f4b0dcfa9ed31d874c579a1c486f2233a2303aad210102b8c2c8d9cf06
4eae100521922e9249c423378708ecc0d393502c68bfc3216dbf75ca0faef949
8d989a16837d23dd2fd12b69b133e43c2ae1bbb68b171736a75dd9af898b00a5
0712a4ddc18386e86ad4f2ae1d37ff55dfb1850cdad6d9c66162c58cd5048935
01b9ae05c0c5d50490c05aa2e2873b77a71792adf7c9fb0a1205780a70547192
SH256 hash:
7e26e19ba215af997b4333ae4559ed1ff66c192f505432f3d591a6198a5da1a4
MD5 hash:
3789167e4fa3fc3ecaae2e25c1d028d8
SHA1 hash:
30c80bdf39579995159d4b9d806216738a9e3f6e
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/736212f4-820b-4d40-9a6a-e0fcbe290131/
Parent samples :
54347c92b3f40ffb6e06b6c2491094dd9a35c84a2eeb09ec15e20ba0b69e1cd5
0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19
4b821e183fd57320849d7999495a583e0a74ee4bcffd59daefae37534f736393
25223dcb5c58948525d07a527f3d60b9ac1d5066f158ca0dd9cfcdde0570f9ed
116b4fa2541f40e452d7aa04de03095d97a8fcb5d2f118ec60b112e228d42062
27939e0c5b1fe6f52d27e4bc1fa21b9e20837e0aa4a7d6a12a8564fcc8928106
dcbfe3857cc6ba5394a223008422349ca296cc676f7f60618b0b3cc67f7a5597
df282ea63eecaa2e3e46c39748f5a2be5e885cdcf0d857258b13957808ecdb52
da29c485d19eaa1e567d555db19a7bb5a5e74df17be79f7817a42c0cca1566ff
f5e4e57c0c6b27846676f07828e2dc02837f03f83da2471701fbadea52fd742c
1f8f52ad901f6f1f77494997aeb7c94c4e8f6c031a170a92cf1d1eac5ef4a0bd
883e13b0ee3b095b37bf146fa5d4f0dc428bb68daca717e98f28c769cde5c7dd
09e1d06be43c59027f2315088f1c53cca84aae43489f9639f907de6e327d9628
718034f9b541fdf7866851cd4ced6b406e07952944717e4291b38e75ac763e12
febd6964bdd7f4d619fa5b9fa4cab9664544370704d3cf04976eb8c520825c2e
680fa23ffd5f8185eb50f54932becc71d2d3b51b39033f853c4ea2e8737e34f0
b824349984caaa7351d0c62a0b04e0ff3412834c24e7f9f29e9c1459c525ccb1
6dda6c6e5f927c449bb2e3748eaa9329aab3c6c3f9f54bbdaf8f49d33f844a56
399139bc23966f9509eb7bcc58f880e52df62c293f800d704bff96e0b0e8d09f
edb1307f1fd091e464831bfc974dc7c4db9586095f3112a3bed99f5601213eb8
ee5754e39b22b6758e5d2b940a0cfc11835a80779073148028a6222a7e37e086
9fc1d2f4b0dcfa9ed31d874c579a1c486f2233a2303aad210102b8c2c8d9cf06
4eae100521922e9249c423378708ecc0d393502c68bfc3216dbf75ca0faef949
8d989a16837d23dd2fd12b69b133e43c2ae1bbb68b171736a75dd9af898b00a5
0712a4ddc18386e86ad4f2ae1d37ff55dfb1850cdad6d9c66162c58cd5048935
01b9ae05c0c5d50490c05aa2e2873b77a71792adf7c9fb0a1205780a70547192
SH256 hash:
a2dcaa7e6a5dc08488f877b88719ebf1bfde81c42e4ac8a32a30cfd98b7f9e80
MD5 hash:
95f3a064db0e7e03247f011689203646
SHA1 hash:
104e38e3fab9e96cca5d0a6b130e3d539707c911
Link:
https://www.unpac.me/results/736212f4-820b-4d40-9a6a-e0fcbe290131/
SH256 hash:
0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19
MD5 hash:
7a780fbbb30ed7f241d5c9dccd10b065
SHA1 hash:
5c0e629984f5720e57e137abc4125da70b224097
Link:
https://www.unpac.me/results/736212f4-820b-4d40-9a6a-e0fcbe290131/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0cf5912e01d6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 0cf5912e01d61db285fb01b7b04971117fae86129a583cce83aee5482e844c19

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/423961/
  
URLhaus
https://urlhaus.abuse.ch/url/2675259/
  
URLhaus
https://urlhaus.abuse.ch/url/2675558/

Comments


Avatar
zbet commented on 2023-07-18 15:49:27 UTC

url : hxxp://87.120.88.198/g.exe