MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f3085fd9ea4a3f8732480e4547f39d188ee1b4f6246240577917f0bf387b2c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f3085fd9ea4a3f8732480e4547f39d188ee1b4f6246240577917f0bf387b2c9
SHA3-384 hash: c37330c874e3198c8b4cf52dfeca540f026821621f1e24d906ec3360d6b6b5c4bc1c2236b3f43942a2386d91cc171b08
SHA1 hash: 92423f9c51a942770d5b8367359cb7b7bc6990ad
MD5 hash: 3d7e4559297b28966c6f797b025a21e7
humanhash: chicken-virginia-earth-nitrogen
File name:3d7e4559297b28966c6f797b025a21e7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:323'072 bytes
First seen:2022-10-10 20:10:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f649642db70f229fba6aec1f99f0e147 (5 x RedLineStealer)
ssdeep 6144:C3sv1YUjOjCli8CUabPTqlDVf6jS5AOBhWtlqcT8c32N:WstFjO+88CUajw/hWtlqcAN
Threatray 5'808 similar samples on MalwareBazaar
TLSH T11164AE5034D084B1C87F14B649F78B789A3EB9E0CBA55CEB57841BF94F243C2A7325A6
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
79.137.192.32:43204

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.137.192.32:43204 https://threatfox.abuse.ch/ioc/872581/

Intelligence

File Origin
# of uploads :
1
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318645/
Detection(s):
Win.Malware.Pwsx-9963812-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63447c581ddf36bcc3f4490e/reports/ca76fd69-ddc3-4c33-8266-d76b1cf9d3c5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c4030b1e-2bb8-4a76-ab34-f63e581be1cb
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087221
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f3085fd9ea4a3f8732480e4547f39d188ee1b4f6246240577917f0bf387b2c9/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-10-07 00:15:06 UTC
File Type:
PE (Exe)
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4yil7m6usr7q4zeqdsfi7zz2geo4g2pmjdciblxsf7qx44hwleq._file
Verdict:
malicious
Similar samples:
1c7abce8a9183e0573ce4a2dccb65bc01bb3c78743e28bc5f3d13f340d7ff322
RedLineStealer
2e442f59d4b93e0bd914cf49e47b2095b969cc742d9a3615e3d324e495cd2fe8
RedLineStealer
5d72a91ee3aeab2a634e8023b2c0530c8429f1151f1e29421ff7a16cec75617d
RedLineStealer
9f8ed5976f0221e19b5a8edd4127fb72a17b2d37be6fe8e9f5e0b8761c05349d
RedLineStealer
bba50bad1c1ca3d8e311cf17c45693949838403569d6fdb49fe0699eb9ee3202
RedLineStealer
d654da41efe42b81af4b230b841203465281672f9721028cb5f78fa01d3c7e67
RedLineStealer
f661ec60e29f3bd12a3d4db867d37cd78ab2104f7c27b63624433a66d514113b
RedLineStealer
+ 5'798 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221010-yx9knadcal/
Unpacked files
SH256 hash:
0f3085fd9ea4a3f8732480e4547f39d188ee1b4f6246240577917f0bf387b2c9
MD5 hash:
3d7e4559297b28966c6f797b025a21e7
SHA1 hash:
92423f9c51a942770d5b8367359cb7b7bc6990ad
Link:
https://www.unpac.me/results/afd12a73-dcbd-4f19-adb5-da4afe6caaa8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0f3085fd9ea4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f3085fd9ea4a3f8732480e4547f39d188ee1b4f6246240577917f0bf387b2c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318645/

Comments