MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
SHA3-384 hash: 5d44522e28af0c16d60ba4fadc79a3d5127e75921f236572901df65a79ff520a016d6d4f74d0b04f5ee3be865cd36825
SHA1 hash: f33b60cc6f2c1275b41052a922468adf4cbd0831
MD5 hash: 87e0e10851699adc6f467b5c9a2532b7
humanhash: sierra-yankee-butter-massachusetts
File name:87e0e10851699adc6f467b5c9a2532b7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:401'920 bytes
First seen:2023-02-05 07:40:12 UTC
Last seen:2023-02-05 09:37:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d027e1822da283963b2da86a5b0354e (17 x RedLineStealer, 8 x Smoke Loader)
ssdeep 6144:+Mz1xouLE53OUZflc2OYxeYOAEw8s42A2:+Mz1xouA53OJHwy2
Threatray 15'887 similar samples on MalwareBazaar
TLSH T18384F1323AC0C133C55659306C68DA91BABEAC3129748E5B7BE407A99FB13D1637734B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 816a6e6a6a6a6a64 (15 x RedLineStealer, 8 x Smoke Loader, 6 x Amadey)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
62.204.41.170:4172

Intelligence

File Origin
# of uploads :
2
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
87e0e10851699adc6f467b5c9a2532b7.exe
Verdict:
Malicious activity
Analysis date:
2023-02-05 07:42:42 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/b4d52c3b-dc12-4494-b091-5be2c2b66575

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/360361/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.2793.26416.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63df5d911c9cbf7d6255ee4d/reports/3ef49d2d-e428-42b1-826e-47cc63369cdf/overview
Verdict:
Malicious
Labled as:
Ransom.51A80467
Link:
https://www.hybrid-analysis.com/sample/103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/492ecacb-92c1-40a0-865b-5f4c81f85cd7
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1165952
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b/
Threat name:
Win32.Ransomware.Stop
Create hunting rule
Status:
Suspicious
First seen:
2023-02-05 07:41:09 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ca7ryjnkvqlmhgwkg3fgfgy2woyseylqouyhjlusj4t4amtk74nq._file
Verdict:
malicious
Similar samples:
09b749cb035fd17bc749c1738d1f35f35500df7b157552f26f7570d80f8acde1
RedLineStealer
2fc20c39599a1a7f6d4bfda33562581622c15a3a7a92db8185b6de41eba56ed1
RedLineStealer
6fbf44183c6ed6ebe3f188f187afe712574c34d9787cdf40c5bcbb07f6d50fb7
RedLineStealer
853d470cb6c7a48e716a178ab202715abbd3972e04f4a580c3b335624c6e4062
RedLineStealer
98b338db8e45e180cdc512c6dc83128354d3a6f64f5da8d538963dcc9c6a2342
RedLineStealer
a2224d02026b17afced0929449070dc642ca5682b7993dd892aa56ff1dec45c4
RedLineStealer
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
RedLineStealer
ef837e4549085f90fccd5b3a25082480ea20102458889ea8576c2714404086ea
RedLineStealer
f3162a139191ee7ab512dc14be6002712818fb4b00a3de5dc213d62c6c08beba
RedLineStealer
fd175c2b3abdea1356f213078f594cd33d643c39ce9db3360f30263bbafa90c9
RedLineStealer
+ 15'877 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:zaur discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230205-jh4njagh56/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
62.204.41.170:4172
Unpacked files
SH256 hash:
2a62ac253b6cd959b7131d37268d99bc515a09343e985cebda911d403bbf224e
MD5 hash:
314b2f270faf2d3af32447d1a19e873e
SHA1 hash:
88228152e3351a0cb3906e610fe05787ce814d7c
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/c67b1ad0-791f-4958-bc08-a8e2bab548fe/
Parent samples :
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
7becab35b4300ad3c0be8e7dc12f311b140cb8a7b5338e0102fcf6f71c97157d
15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
1498389b39bb5db52d583bc40f9e021934d53bbf8b363809ca0d4e58f9ba30ef
fcc8a1cd9b32433a8735fae44718bc36b2ea00b96df212c9d63186031d7af10d
ebd46441b3e3a1c1e64d6b0952dacb9bcdd896bb95c8a62bc3a4028a58b1573c
caf51bbc26408a0d9e3b24595b0318e128b9bc98ce713fa936ffbaadea6a33ad
0e36e23f795621dce7b398b59cbb4db16683da88e133210f1bb17879b1dc94a6
SH256 hash:
2bea5697de809ccf492aa11315b9e5cbca8f6b478b7bdc518a90289eac27ea58
MD5 hash:
a4e324d41c32fd96abf9b1120fd06337
SHA1 hash:
1a06765964d3802ece0b6f1c4c73d6d2b33d1296
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/c67b1ad0-791f-4958-bc08-a8e2bab548fe/
Parent samples :
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
caf51bbc26408a0d9e3b24595b0318e128b9bc98ce713fa936ffbaadea6a33ad
SH256 hash:
7e39c951b6d469fa7e68bdcae3bfd9a98ad100a2b2db55dae88e71640823f65e
MD5 hash:
685932fb80294b302dd6b0910f692421
SHA1 hash:
02193d6758faa9808ef2e5b5e8d96665906d77ba
Link:
https://www.unpac.me/results/c67b1ad0-791f-4958-bc08-a8e2bab548fe/
SH256 hash:
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
MD5 hash:
87e0e10851699adc6f467b5c9a2532b7
SHA1 hash:
f33b60cc6f2c1275b41052a922468adf4cbd0831
Link:
https://www.unpac.me/results/c67b1ad0-791f-4958-bc08-a8e2bab548fe/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/103f1c25aaac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2528642/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2529227/
Cape
Cape
https://www.capesandbox.com/analysis/360361/

Comments