MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16dd8a22b82372491d537d12f0a0574a3756d1a225994d7d6f738fdcf1b10f2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16dd8a22b82372491d537d12f0a0574a3756d1a225994d7d6f738fdcf1b10f2d
SHA3-384 hash: 6f75307c5c4f0e99a4085cec0b264d54405d7dbd866a03128295109a116b2176afeb4476ebb95a920d913121641771ff
SHA1 hash: bcd2a6ee000e59049663b66c639479a3e8d357a5
MD5 hash: b48353aafc202ccc69e729a30d287388
humanhash: seventeen-juliet-north-crazy
File name:16dd8a22b82372491d537d12f0a0574a3756d1a225994.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:393'728 bytes
First seen:2021-07-08 16:05:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6877f946bae2ca0d9e53a3d1d23bfb5c (4 x RedLineStealer)
ssdeep 12288:bIzTY84IbJb83sdQyr1oOM5Q6RNXofFb:KY0I0Qyr6Y
TLSH T158849E00FBA0C035E6F326F45A7A92B9A93D7EE15B2050CB52D46ADE5B346E0ED31317
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
65.21.122.45:8085

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
65.21.122.45:8085 https://threatfox.abuse.ch/ioc/158437/

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://host3rdr.cyou/?q=Modbus%20Poll%20[v9.4.6]%20Crack%20+%20Registration%20Key%20(Latest%202021)%20Free%20Download
Verdict:
Malicious activity
Analysis date:
2021-07-08 08:09:42 UTC
Tags:
autoit loader evasion trojan stealer vidar rat redline phishing ficker
Link:
https://app.any.run/tasks/57158ada-cf14-46cd-8c0c-72aaba98ea75

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170506/
Detection(s):
Win.Packed.Generic-9876400-0
Create hunting rule

Win.Packed.Generic-9876586-0
Create hunting rule

Win.Packed.Generic-9876630-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0f4b5681-12da-4c0f-adaf-21cdddfb1e8a
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/813624
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16dd8a22b82372491d537d12f0a0574a3756d1a225994d7d6f738fdcf1b10f2d/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-07-08 16:06:13 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c3oyuivyenzeshktpujpbicxji3vnuncewmu27lpooh5z4nrb4wq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:1 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210708-ejk7n13cq2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
65.21.122.45:8085
Unpacked files
SH256 hash:
6c9e9f192ed80ced9ee3c546c8ec4eeede390260eeadadcd6e7067a1bd44a580
MD5 hash:
fe4893016ace0474e37516ce0f3465ea
SHA1 hash:
8a0c2c5ce60d36807a8d7ef36abce61392bbec1b
Link:
https://www.unpac.me/results/ea16073c-f13b-45cb-8396-e8af479f2192/
SH256 hash:
9b8bf30d2a4a7fe1d7fc6339a4fa4c4f486bdd207d71bc8a23d2c481b2587cfc
MD5 hash:
84ea6400bcf32bd9904ee92309b965b4
SHA1 hash:
742f297b4a20a013f316099ed9d58bb391cef910
Link:
https://www.unpac.me/results/ea16073c-f13b-45cb-8396-e8af479f2192/
SH256 hash:
17a78f410f928de8028b784d7e20ccf58ed56e3455e8942cb1c5ca88e181b631
MD5 hash:
be4540e401e3e3fc0d5769c0e22e6e4d
SHA1 hash:
1407bf3b8f9f109e0b685184d438926bbd820b2f
Link:
https://www.unpac.me/results/ea16073c-f13b-45cb-8396-e8af479f2192/
SH256 hash:
16dd8a22b82372491d537d12f0a0574a3756d1a225994d7d6f738fdcf1b10f2d
MD5 hash:
b48353aafc202ccc69e729a30d287388
SHA1 hash:
bcd2a6ee000e59049663b66c639479a3e8d357a5
Link:
https://www.unpac.me/results/ea16073c-f13b-45cb-8396-e8af479f2192/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/16dd8a22b82372491d537d12f0a0574a3756d1a225994d7d6f738fdcf1b10f2d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/170506/

Comments