MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57
SHA3-384 hash: 379c09deb6d0984ee39e5f388d145f76b989d71d52c4c7bfd67e81d156475fdd028fa089cb8db6f6c9a086cac254511e
SHA1 hash: fcacac94431f772151f206400f255c3b493f14ea
MD5 hash: 133e916268d3f97ca4e2751a1c8bcb1a
humanhash: july-tennis-zulu-kilo
File name:133E916268D3F97CA4E2751A1C8BCB1A.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:443'392 bytes
First seen:2021-05-10 10:25:24 UTC
Last seen:2021-05-10 11:02:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 21eecbc834e52df22aae59eb1273e389 (2 x ArkeiStealer, 1 x RedLineStealer)
ssdeep 6144:TZ/y7p5N9WTPblZd7ou9+Tf9x/6ywEHOe9Yvv3xHIuk70GVJjw3M1MXmIUe8u:TZ6l5DglZdMug9xQoYnJIuy0GVJemW
Threatray 515 similar samples on MalwareBazaar
TLSH 0994BE117680D072CC261D794065CB799EAFB8366F229E8BAA8D2779DF307D1B731309
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
176.121.14.43:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
176.121.14.43:80 https://threatfox.abuse.ch/ioc/34409/

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/153919/
Detection(s):
Win.Malware.Generic-9859703-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/777251
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57/
Threat name:
Win32.Trojan.BotX
Create hunting rule
Status:
Malicious
First seen:
2021-05-09 09:06:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwi2uqer27vlpu5s4c5dkmsbuhtuorvfygqc74tcscdubbp3nvlq._file
Verdict:
malicious
Similar samples:
2de5bd332d8d0c6b405cb6c8309858f67c33fc1db5ab1e36cf619f1c434bfd45
RedLineStealer
2efb4d4bb7e9141474ee5ae3f8c40274c5ab675b33836ac31a8ec554dd76a9bf
RedLineStealer
3402ccadc0caee011653d08f4c1da3c2c55fa27f0960e0e1ae83a30dda9dc472
RedLineStealer
45cfc2ce1e033a00c42202e16a7ba83229688d49d7776e175488c56aade45558
RedLineStealer
53da132fc1d27a6b79fe0d6823777ffb083422661bc8b223c41f28f171658a8d
RedLineStealer
5ad8c577246cf6b0b4e441a43921889d5a5ddc5e75791241eec78f6065f6734a
RedLineStealer
877c1cec3dce25939698f1f459f4b68a1d9ecdb3c7ebc82f241e136ead494731
RedLineStealer
a0faa82eeb65dec2d55e0041f18eb27652dafd93dc25e105927303e277cd8df6
RedLineStealer
d01e422aa4991ad20614a95f4358ebcbf919e983feba67edcd43bd46486657b7
RedLineStealer
e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a
RedLineStealer
+ 505 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210510-1wbq4xyak6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d91aa4091d7eab7d3b2e0ba353241a1e74746a5c1a02ff26290874085fb6d57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/153919/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-10 11:03:37 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
1) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
2) [C0049] File System Micro-objective::Get File Attributes
3) [C0052] File System Micro-objective::Writes File
4) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
5) [C0040] Process Micro-objective::Allocate Thread Local Storage
6) [C0041] Process Micro-objective::Set Thread Local Storage Value
7) [C0018] Process Micro-objective::Terminate Process
8) [C0039] Process Micro-objective::Terminate Thread