MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments 1

SHA256 hash:	0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f
SHA3-384 hash:	894d52f4ab2e81f2e1ffa33e430764f8f6d7740daabcc7ea4f50be7efd35202bfd0de8d39c47338175405e3b43e3b739
SHA1 hash:	04c1ea711ed7077cee2b67c33577caadc24b97e8
MD5 hash:	738f696f228f13c18454c013926b38b2
humanhash:	lemon-april-cola-carbon
File name:	738f696f228f13c18454c013926b38b2
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	455'168 bytes
First seen:	2021-11-04 12:32:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e024db68009cf7f32dd817cae1867bf3 (6 x RedLineStealer, 2 x AZORult, 2 x RaccoonStealer)
ssdeep	12288:JK4vC5FqRKSItKle0HFPg0VPT8L5A41AuHWcNX:Y4vAKKQHFTPYwuRX
TLSH	T107A4C000A7A1C034F0B652F889B69269B53F7AA1AB3890CF13D567ED5734AE1EC71317
File icon (PE):
dhash icon	badacabecee6baa6 (95 x Stop, 87 x RedLineStealer, 62 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

738f696f228f13c18454c013926b38b2

Verdict:

Malicious activity

Analysis date:

2021-11-04 15:31:19 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/89860560-b059-40ac-a84a-8023515ed37d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/202318/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.79584.31425.11477.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6183d302c03a81a5023f951b/reports/a1809f71-7c7c-446f-9ae7-ef2418461ea7/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6571c776-38b5-41c3-85c0-c705bb0bf266

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/883158

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f/

Threat name:

Win32.Trojan.Reline

Status:

Malicious

First seen:

2021-11-04 12:33:05 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=b7efhto5w4mv3p3akktzocw5nvolk73lp4shr5xd3yqp7b74rehq._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:love discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211104-pq79ksdgcm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

91.242.229.222:21475

Unpacked files

SH256 hash:

812e8eff53e9aceb375051b9b8894a927474eacb2120f05e06719353c14b612e

MD5 hash:

1395c5e3d3295682b60f2c8b58d72634

SHA1 hash:

5dcf0d4e686260b28ac21bdeb28f47559b41bb0f

Link:

https://www.unpac.me/results/68d4f3d2-ecde-492a-a5b5-e6f5ac714af8/

SH256 hash:

1ee866f681c44702f4705c548ec11f3cad4290e926ae883ed9d1e319065a5604

MD5 hash:

bce091b2c1fe6603dfc6a6a85c106058

SHA1 hash:

b7ebabb532054d9b5eeb3153086bfd16044246e9

Link:

https://www.unpac.me/results/68d4f3d2-ecde-492a-a5b5-e6f5ac714af8/

SH256 hash:

f34b1141bad5c33ccba009b9af85bd82d60d5719b2c8828893f6b145ac57c307

MD5 hash:

086b8a18d7f52f0e86427bcd9689930c

SHA1 hash:

d2e8159d80809df1dba527b374a697a73224092d

Link:

https://www.unpac.me/results/68d4f3d2-ecde-492a-a5b5-e6f5ac714af8/

SH256 hash:

0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f

MD5 hash:

738f696f228f13c18454c013926b38b2

SHA1 hash:

04c1ea711ed7077cee2b67c33577caadc24b97e8

Link:

https://www.unpac.me/results/68d4f3d2-ecde-492a-a5b5-e6f5ac714af8/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/0fc853cdddb7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.