MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
SHA3-384 hash: 8809c46e6b553e45346c3fb9b2c3c1040c6b75b34942bcaacb66b099d9dfef1e765a0daffc1cd4ab878e848c421812f7
SHA1 hash: af839fc936259a6b5e128ccea0cf1fff2b94749a
MD5 hash: e3ee934aab38c77d012238f22d367ca4
humanhash: equal-double-nevada-william
File name:e3ee934aab38c77d012238f22d367ca4.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:310'784 bytes
First seen:2023-02-05 11:35:11 UTC
Last seen:2023-02-05 13:33:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c2ffc2f9d3c1d139c5f92bcaf8cdb977 (5 x RedLineStealer)
ssdeep 6144:tgcNIhLzBCVaTOwO7wv5XxUJtR1wGCTKKTuAsGc7AXFKHhCoSg:tgcNIh/BeaTOwCCds8dWQvSEXFw
Threatray 15'877 similar samples on MalwareBazaar
TLSH T18D64013239A0C072C1E719344970EBA567EF7421167A895777AA06AEBF303D19B3E347
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 916a6e6a6a6a6a64 (27 x RedLineStealer, 23 x Smoke Loader, 10 x RecordBreaker)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
62.204.41.170:4172

Intelligence

File Origin
# of uploads :
2
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
e3ee934aab38c77d012238f22d367ca4.exe
Verdict:
Malicious activity
Analysis date:
2023-02-05 11:36:28 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/ba15e82b-885f-422d-b350-ea9ab89a2ca3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/360397/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.28258.10610.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63df94a3447edb203a02d020/reports/08c3d22d-4327-4a0f-b8f1-72b67eb23283/overview
Verdict:
Malicious
Labled as:
Ransom.51A80467
Link:
https://www.hybrid-analysis.com/sample/15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/90fb798a-e963-497a-8781-669cb7ddda00
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1166002
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2023-02-05 11:36:07 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cuaz45h6spqtfvqnj572p4vshft4npygowjwycducf3ggbt7rb2a._file
Verdict:
malicious
Similar samples:
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
RedLineStealer
2fc20c39599a1a7f6d4bfda33562581622c15a3a7a92db8185b6de41eba56ed1
RedLineStealer
7becab35b4300ad3c0be8e7dc12f311b140cb8a7b5338e0102fcf6f71c97157d
RedLineStealer
9464f4a21163e9b91c5b532f17eca2d9079aed8126565fe02ca2dc022bb3b084
RedLineStealer
c8e977f7e13452f9dd35f0dbecedd223d8d882ab78d9373232c3d807fe37ba62
RedLineStealer
cdfdc2becd5e3531a967dc8356ea89d087826f53e320c98bb569dcfed1b2cae5
RedLineStealer
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
RedLineStealer
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
RedLineStealer
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
RedLineStealer
f3162a139191ee7ab512dc14be6002712818fb4b00a3de5dc213d62c6c08beba
RedLineStealer
+ 15'867 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:zaur discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230205-nqkmvace3z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
62.204.41.170:4172
Unpacked files
SH256 hash:
bd306f1eb9573ca90c359ba059a7ee3e4f2fa81b94886544efbc70fab6b0c529
MD5 hash:
cf661fb505ff59ab4942e70962ff54ce
SHA1 hash:
8eea31a315019e342388a838ab256c4da990b5dd
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/d588202f-a383-45c6-b718-4014649241ec/
Parent samples :
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
7becab35b4300ad3c0be8e7dc12f311b140cb8a7b5338e0102fcf6f71c97157d
15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
1498389b39bb5db52d583bc40f9e021934d53bbf8b363809ca0d4e58f9ba30ef
fcc8a1cd9b32433a8735fae44718bc36b2ea00b96df212c9d63186031d7af10d
ebd46441b3e3a1c1e64d6b0952dacb9bcdd896bb95c8a62bc3a4028a58b1573c
0e36e23f795621dce7b398b59cbb4db16683da88e133210f1bb17879b1dc94a6
SH256 hash:
2a62ac253b6cd959b7131d37268d99bc515a09343e985cebda911d403bbf224e
MD5 hash:
314b2f270faf2d3af32447d1a19e873e
SHA1 hash:
88228152e3351a0cb3906e610fe05787ce814d7c
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/d588202f-a383-45c6-b718-4014649241ec/
Parent samples :
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
7becab35b4300ad3c0be8e7dc12f311b140cb8a7b5338e0102fcf6f71c97157d
15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
1498389b39bb5db52d583bc40f9e021934d53bbf8b363809ca0d4e58f9ba30ef
fcc8a1cd9b32433a8735fae44718bc36b2ea00b96df212c9d63186031d7af10d
ebd46441b3e3a1c1e64d6b0952dacb9bcdd896bb95c8a62bc3a4028a58b1573c
caf51bbc26408a0d9e3b24595b0318e128b9bc98ce713fa936ffbaadea6a33ad
0e36e23f795621dce7b398b59cbb4db16683da88e133210f1bb17879b1dc94a6
SH256 hash:
7e39c951b6d469fa7e68bdcae3bfd9a98ad100a2b2db55dae88e71640823f65e
MD5 hash:
685932fb80294b302dd6b0910f692421
SHA1 hash:
02193d6758faa9808ef2e5b5e8d96665906d77ba
Link:
https://www.unpac.me/results/d588202f-a383-45c6-b718-4014649241ec/
SH256 hash:
15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
MD5 hash:
e3ee934aab38c77d012238f22d367ca4
SHA1 hash:
af839fc936259a6b5e128ccea0cf1fff2b94749a
Link:
https://www.unpac.me/results/d588202f-a383-45c6-b718-4014649241ec/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/15019e74fe93/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2529227/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/360397/
  
URLhaus
https://urlhaus.abuse.ch/url/2528642/

Comments