MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a
SHA3-384 hash:	fc9b4b5633296b3e69ca2c2ce9aff30d088294f2072b86d7b6c925fa2eaff84f07a70f930b945b9b13a9f2b8c128e84b
SHA1 hash:	7523f9775110fb39fc8fca1d05a32335ee334f20
MD5 hash:	793261a9a21202c4d00108bc67fe3798
humanhash:	blossom-south-oklahoma-alpha
File name:	793261a9a21202c4d00108bc67fe3798.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	400'896 bytes
First seen:	2021-10-03 16:30:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e1dc734f9d3fd8ffe237c21274508ba5 (4 x RedLineStealer, 2 x RaccoonStealer, 2 x ArkeiStealer)
ssdeep	12288:w/gKsuT3oiPw0CMu6lmOI/efFiL6+zxF6L:wHDTr4s9lfQJL6L
Threatray	7'087 similar samples on MalwareBazaar
TLSH	T11084CF093690CFF2D6B605B1AB16E7F54A6DB86C5C35424F2B94372EBF3D391AA21301
File icon (PE):
dhash icon	fcfc94f4d4d4d8c0 (7 x RedLineStealer, 7 x RaccoonStealer, 3 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

129

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

793261a9a21202c4d00108bc67fe3798.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-03 16:34:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a792fc30-690d-4bd6-a221-aaf23910ffdc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/194367/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c269efef-9b1e-443e-9891-accf81598928

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/863467

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-10-03 16:31:11 UTC

AV detection:

23 of 45 (51.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cheitgcnux74qjlrxvx3o7gojtgxfpcoa76w26nx4drzufgdq55a._file

Verdict:

malicious

RedLineStealer

360099a2671501102cf321e820d7d80f997effcea91ff43c7251ba2313af5c94

RedLineStealer

3f8b10edee659fb77181d28955a822548a0f3e95dc14a35170bcf47f126dde6a

RedLineStealer

4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10

RedLineStealer

719838a1192ae6b53966159da56635e7a05754eb017f2538ca3f82c580543280

RedLineStealer

73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e

RedLineStealer

a95df870da90caddc739ba5c272c1f3db50fa8f7671a399abc7f0bb84a15b8ce

RedLineStealer

ae4e86797fd91e9bef807f0bd822d0c77f37b03e20eec889bc0ae9f9af738b32

RedLineStealer

c0229d60231c1631796fb5f3bb37f8a814e599bafc0b4f72c17c0e232a2e3176

RedLineStealer

cfa3fbc90f716e334b59c121fc7374b2adf4b5290bf461007a5fa514b5338553

RedLineStealer

+ 7'077 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:pub infostealer

Link:

https://tria.ge/reports/211003-t1c9eafeb4/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

7de1f501c6f4edfbb3e61dda5d445b4482235420e19cd3e193ae3be26d374367

MD5 hash:

858ebd87027f4c3adcb5e2c59ec5161c

SHA1 hash:

f758ceef9690fb7430c910fcffd71c0cdb456834

Link:

https://www.unpac.me/results/54dce647-bdc8-441e-8796-367669c4cd2f/

SH256 hash:

541526a7b80a64b50c770517545d25c0515a146c3ddc5600a65d91cfdaf5e3a0

MD5 hash:

d964fece1f6eade1b3b0ab1ca479d7e1

SHA1 hash:

cf6948b22255272da7d81e38a936ee90b95c17ee

Link:

https://www.unpac.me/results/54dce647-bdc8-441e-8796-367669c4cd2f/

SH256 hash:

4e04bba712969aa15782d796bd66233e30de2ceb2fd6f23f8ec88b64b4857636

MD5 hash:

26e6a498e6fdb35574c6a6e51e0b7d1c

SHA1 hash:

394bd2b1362a1fe2fb96cc69971fa08c43bcbf14

Link:

https://www.unpac.me/results/54dce647-bdc8-441e-8796-367669c4cd2f/

SH256 hash:

11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a

MD5 hash:

793261a9a21202c4d00108bc67fe3798

SHA1 hash:

7523f9775110fb39fc8fca1d05a32335ee334f20

Link:

https://www.unpac.me/results/54dce647-bdc8-441e-8796-367669c4cd2f/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/11c889984da5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.