MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17af10af31345b400e46dc8f075c5d092b3df3d07423949196950b28ff23d7f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	17af10af31345b400e46dc8f075c5d092b3df3d07423949196950b28ff23d7f2
SHA3-384 hash:	fdfa37eb4a16d646b7138037827840e3f8be6bc5516a7dda5431982262050a68e1f2799477ec9bb3534a36fcc099fd62
SHA1 hash:	ee2741f095c8dbd12c8ef83e330914134e375d86
MD5 hash:	c38785926604468a03a0331e4f57cec8
humanhash:	bluebird-berlin-island-tango
File name:	c38785926604468a03a0331e4f57cec8
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	362'496 bytes
First seen:	2021-11-10 08:46:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	959e3f7a6ddd7b4ec96854ed6fe13765 (6 x RedLineStealer)
ssdeep	6144:F4VUSuBfm2sL+ZdtukM+gnNguBitEJMBJSFo7KgD2oBdGuzbgwujigaLwVf:F4VUSuBfE6dtajguAt5SS6oTGunnb
Threatray	3'777 similar samples on MalwareBazaar
TLSH	T10674D031A7A98835E59B1F3958E187A00A37BD2229B0504AF760171E1DB3FDC86FD71E
File icon (PE):
dhash icon	fcfcb4d4d4d4d8c0 (70 x RedLineStealer, 59 x RaccoonStealer, 24 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/204647/

Detection(s):

Win.Malware.Fragtor-9907126-0

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/618b8708dec3347825a11190/reports/6caffd24-096d-47b5-9d1a-05b4b0e2ed9a/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/147dd733-37d6-4961-8658-b49ec30193e2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/886568

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/17af10af31345b400e46dc8f075c5d092b3df3d07423949196950b28ff23d7f2/

Threat name:

Win32.Ransomware.Convagent

Status:

Malicious

First seen:

2021-11-10 08:47:05 UTC

AV detection:

18 of 45 (40.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c6xrblzrgrnuadsg3shqoxc5bevt346qoqrzjemwsufsr7zd27za._file

Verdict:

malicious

Label(s):

asyncrat

RedLineStealer

6a7af1d145e133bfd37416108227befcfd1c15597f3a05fdf39ec95b9e8f1cfe

RedLineStealer

829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82

RedLineStealer

9b8839c52246d01b747d37af34403a800ac06bd4d1441ed948e0d06fc12307f7

RedLineStealer

ca7b59a716d7f6caf24ad2258751b0a3fb8fd174a3c36e44375178500f7714d9

RedLineStealer

d68549067554697569e1566c1e4c993a7e84dae92fb30e39ac9f4fc184e48cd1

RedLineStealer

+ 3'767 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:1132044836 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211110-kpv6eagfa7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.183.32.184:80

Unpacked files

SH256 hash:

9c6341b148ac2906f5c468d3932d5df78a8e08065a90a3598f3479aa459efed2

MD5 hash:

e622241b33225aae0481873b413fc903

SHA1 hash:

daf8a3224ba1cf5574f7f0136d1ecbbd12e6eb00

Link:

https://www.unpac.me/results/76b9fb3f-6740-4e32-b470-94a249fd2811/

SH256 hash:

dab99fbee62e856c3f80521da9022887a2ae33d824212b6b8154dd441775d2c2

MD5 hash:

0733742afbdf09682d9a02de47ae699b

SHA1 hash:

6902bcd64f4cba3d0f8eff816ab2a2bbeeb916f8

Link:

https://www.unpac.me/results/76b9fb3f-6740-4e32-b470-94a249fd2811/

SH256 hash:

b530575b72400c2e1234035e06f23b71cbda53c846cf66d13eeffaf5b53fc854

MD5 hash:

dde07eaa7dec57b2b69b3bf17c7bbf97

SHA1 hash:

224b8ef1870a054fe22930aa4fd85334017d35d6

Link:

https://www.unpac.me/results/76b9fb3f-6740-4e32-b470-94a249fd2811/

SH256 hash:

17af10af31345b400e46dc8f075c5d092b3df3d07423949196950b28ff23d7f2

MD5 hash:

c38785926604468a03a0331e4f57cec8

SHA1 hash:

ee2741f095c8dbd12c8ef83e330914134e375d86

Link:

https://www.unpac.me/results/76b9fb3f-6740-4e32-b470-94a249fd2811/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/17af10af3134/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/17af10af31345b400e46dc8f075c5d092b3df3d07423949196950b28ff23d7f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.