MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde
SHA3-384 hash:	0fee14536bf3082376abae74711c73be94eafa924ae077ca7d6571687c5b004ede510734fc15ea74dcd1e6ed5bfb47bc
SHA1 hash:	11edaf853d941f7921ba4a6bfbaf719df3ac627f
MD5 hash:	a36c888f47eceb950d47caa689236157
humanhash:	minnesota-oranges-apart-hydrogen
File name:	a36c888f47eceb950d47caa689236157.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	399'872 bytes
First seen:	2021-10-03 12:29:29 UTC
Last seen:	2021-10-03 14:14:19 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e1dc734f9d3fd8ffe237c21274508ba5 (4 x RedLineStealer, 2 x RaccoonStealer, 2 x ArkeiStealer)
ssdeep	12288:ddKx7c0ydSRjSspH99d2JDskL6+zxF6L:dAtRydMSspBYJL6L
Threatray	2'541 similar samples on MalwareBazaar
TLSH	T1EE84D0057690CFB2D6B201B6AB16C7E0497DBC6D5C66524F2B98FB2EBE3C391D611302
File icon (PE):
dhash icon	fcfcd4f4d4d4d8c0 (23 x RedLineStealer, 21 x RaccoonStealer, 6 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a36c888f47eceb950d47caa689236157.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-03 12:31:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/aa38136e-0c6b-4b21-9f96-122453715383

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/194340/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.6321.19769.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0777f3f8-13cd-4b05-a832-ed6c9f410419

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/863419

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2021-10-03 12:30:34 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=b2or2t4ls3x3q4ug2qjpsyaabxm6px5ojt6glhesigzi6kpurxpa._file

Verdict:

malicious

RedLineStealer

0ed83aa95f87e65e843b791c92419d0c1d34e5b01cc0be01715009f679ddc220

RedLineStealer

121b446992182d929ea152429527662252f30e2a3ee15468a50015760c7c4f0e

RedLineStealer

24bb15d093025a935e0de62e850056aea484990c713517cd53de6696b5e9db52

RedLineStealer

3f8b10edee659fb77181d28955a822548a0f3e95dc14a35170bcf47f126dde6a

RedLineStealer

53b1759f1d5658a208b6f51a516f511cf56cc847b3f7d589393cea2ed456a8ea

RedLineStealer

719838a1192ae6b53966159da56635e7a05754eb017f2538ca3f82c580543280

RedLineStealer

9f322df416d8c350f577677c1654efde29b5bbfc09e2510403953d1af7e37875

RedLineStealer

b821da19f3f294e14b95e0a9c2b2926fbac983986494e81278ba4d3b7c5502a4

RedLineStealer

+ 2'531 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:uts infostealer

Link:

https://tria.ge/reports/211003-ppgp8sfdc8/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

0af5150a5c8f9a5f2678baf604a172626ed229efb82df96d7c358b27eb035b95

MD5 hash:

45b9ad483e9f5647e8f37dc8824d3831

SHA1 hash:

fe09a099996b14eea72674be9a9a6c5963cf7cb8

Link:

https://www.unpac.me/results/c5ee9410-b2d0-4805-a360-53271b24af83/

SH256 hash:

2fe3f6fc8b9b9f4d1bddc0e97ddd64229da2a069cf199bcd435d14a3e27e4e19

MD5 hash:

f0f9a9448f7a0494d9bf6e11694bfce0

SHA1 hash:

e3d5c8af3b294813b562fead751cc5c2f5c8a51c

Link:

https://www.unpac.me/results/c5ee9410-b2d0-4805-a360-53271b24af83/

SH256 hash:

9fd5a295d9c662d120e8d2688ac4b645c3f4390299e4649b8bf76172f6a66425

MD5 hash:

07e9d4478cddb490f89b0edb4842ab0e

SHA1 hash:

48ea47adc76e29fbb23f8c82c7d1b4761f3216fa

Link:

https://www.unpac.me/results/c5ee9410-b2d0-4805-a360-53271b24af83/

SH256 hash:

0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde

MD5 hash:

a36c888f47eceb950d47caa689236157

SHA1 hash:

11edaf853d941f7921ba4a6bfbaf719df3ac627f

Link:

https://www.unpac.me/results/c5ee9410-b2d0-4805-a360-53271b24af83/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/0e9d1d4f8b96/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.