MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11
SHA3-384 hash: 3fc7d886a23c524574973ae4992fd75b9852f32de5520c204497fb0f869fe4baa057df133c96cf47ac1c0329c360d1e9
SHA1 hash: 77c3aab568172d67bccfaa7394ce2bc9426529e2
MD5 hash: afed93c127e63cdb7f04cd0d855a5ad2
humanhash: muppet-georgia-ink-speaker
File name:afed93c127e63cdb7f04cd0d855a5ad2.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:336'896 bytes
First seen:2021-10-07 08:55:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 654aff1ee1bc89531bd3b96ebe76ae67 (5 x RaccoonStealer, 3 x ArkeiStealer, 1 x CoinMiner)
ssdeep 6144:DQ0pxdeRn6E7/AMiYAXIG++2IljSFgosSqrLGpdPUlLxw0:DQ0jdecE7/nGl2AmFgKqrSpdP3
Threatray 2'878 similar samples on MalwareBazaar
TLSH T1A964BF00AAE0C035F5B712FD497993B9A83E7D715B2890CF62D526EA5A397E4EC30347
File icon (PE):PE icon
dhash icon 6ae8e8e8aa66a499 (3 x RaccoonStealer, 3 x RedLineStealer, 1 x Glupteba)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
afed93c127e63cdb7f04cd0d855a5ad2.exe
Verdict:
Malicious activity
Analysis date:
2021-10-07 08:59:27 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/4c27e850-a792-4053-99a2-2eb01d61b95b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/195716/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Connection attempt to an infection source
Sending a TCP request to an infection source
Query of malicious DNS domain
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/615eb62498a6280f39338437/reports/87b64bd0-e7ad-4d68-92b7-c99365fdac8d/overview
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/866318
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11/
Threat name:
Win32.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 08:56:08 UTC
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cr5idkay4qptdlgxqr3k2zpx4wp7hq533blcnwiuk2byzcwkzuiq._file
Verdict:
malicious
Similar samples:
0cbc80e5bf3b704047e62a5fb878b734c64db3229e0ac3e1ea6e153be0739a13
RedLineStealer
18a991ca66e5a2f3ba4b92dd18171eaa5f7306b8cd7d9aa461e4aaef158e7b5c
RedLineStealer
3eab904378106422ddb6fac7d20dd694919c0b69fe09231435d781e0f1507e0a
RedLineStealer
5cdca6838044c712d83b192f693ae6da288d6cd065f431014f5569cbbe20b589
RedLineStealer
6223f08f2ea185a1cbcef1085ae6bddc64806e80a982acbe8cfb0056de0594a8
RedLineStealer
64fa435686d94f74a3cc546fed84efea58c1ef60454ad9f60939960fadcbaa54
RedLineStealer
848d94df66cf50d90b82ef8b00f374cc585e19f3cb93b4934af33d1e6b41f403
RedLineStealer
a0e565d4dabe4fca53afd035b7c4c0ec68d79e1655042ce42c38e85f18e3dbfe
RedLineStealer
c569326abd44e1e6d0b0a843c41f39c8b06bd1e0085233bdb4024a2289a811cc
RedLineStealer
f59e70c1e2703fd8d6016bad2f6b4ebd7824b52eab2bf63a0fdc96f0a3d16011
RedLineStealer
+ 2'868 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:paladin discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211007-kv1yvacdap/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
178.63.26.132:29795
Unpacked files
SH256 hash:
1b8380160e547aeefc07dfffea1aeb99455605217a59ddfa97b94d30c5ad0498
MD5 hash:
1d855f7b17ad5be5f39a2a7b275b3653
SHA1 hash:
9171599cc03210b0df3ee93cf0735f989df65c2e
Link:
https://www.unpac.me/results/64aa799f-2762-4c40-8697-4cde979c36cd/
SH256 hash:
63daa37ed8cc613c8c14e84659618983046a93046698a4094219d0b485332dc7
MD5 hash:
6f233a4c1dba61a7243b0d06b0cf388c
SHA1 hash:
658fd47cd67a8c60327e5bdd46af77fd56903fd4
Link:
https://www.unpac.me/results/64aa799f-2762-4c40-8697-4cde979c36cd/
SH256 hash:
670d4a54ddad06d7d3bfbc77e5496322cb31304f2e3ddea94b9cbc4017a1498e
MD5 hash:
157295887e68ed133a79ed6887b839c9
SHA1 hash:
4d606e27b46e75307256a1e1677fb1be630a99b5
Link:
https://www.unpac.me/results/64aa799f-2762-4c40-8697-4cde979c36cd/
SH256 hash:
147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11
MD5 hash:
afed93c127e63cdb7f04cd0d855a5ad2
SHA1 hash:
77c3aab568172d67bccfaa7394ce2bc9426529e2
Link:
https://www.unpac.me/results/64aa799f-2762-4c40-8697-4cde979c36cd/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/147a81a818e4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1653255/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195716/

Comments