MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17c782177fd60691f9d7b6e59105d282d6c67dc498a0e22b057623298c74bcb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17c782177fd60691f9d7b6e59105d282d6c67dc498a0e22b057623298c74bcb6
SHA3-384 hash: 83293c451d9240d50e7e0fe0856daeb2a1d8b406523752e68b20cc065b61abf8132d361c3e54d8d1954020783dfd5fcb
SHA1 hash: f1c602d4d8b6d57b85fea0e825364abaf5302e62
MD5 hash: a7b51170196eecc50baf9b558170681c
humanhash: lithium-river-hamper-minnesota
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:355'840 bytes
First seen:2022-11-08 21:27:22 UTC
Last seen:2022-11-09 05:55:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8753cd352cfc32749e4772dadbaaeb91 (6 x RedLineStealer, 1 x RaccoonStealer, 1 x N-W0rm)
ssdeep 6144:xnsIFczAUg2TJW0q0EJr0QOzGlcm9oOypAOe6UJF:5sIFcxE0q0PQ8g7ofpryF
Threatray 1'173 similar samples on MalwareBazaar
TLSH T1D274BF41F9DBD4B1C07212BD0E28C7E59A79B9102A12C99F67D40DBECEE9380DD60B6D
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.110.203.101/puta/softwinx86.exe

Intelligence

File Origin
# of uploads :
251
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-08 21:29:01 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/ef20e7bf-b855-4140-9d4d-609c025f06fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/330840/
Detection(s):
Win.Malware.Exploitx-9967939-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/50273/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/636ac9e547330babc05ffdac/reports/ca4134c6-055c-416c-9777-6ef5a177fa4d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df117c34-007a-44f6-a1a0-19816283e80d
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1108676
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17c782177fd60691f9d7b6e59105d282d6c67dc498a0e22b057623298c74bcb6/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-11-08 21:28:10 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7dyef372ydjd6oxw3szcbosqllmm7oetcqoekyfoyrstdduxs3a._file
Verdict:
malicious
Similar samples:
266cd48dfe2f2be1e1a5837d1e7976146ed0e3e43b8309b157df5e002fc7c300
RedLineStealer
4ea1794bc1cee4c7fd13b64636ed8a16c69b9dbd37e6d31bd19b04e9d9c08f3b
RedLineStealer
a318f1ca00e14202a0b3a59aa88a4fefd51d77d19377b360cfa87dc4b6d639ad
RedLineStealer
bb6bebc2da9a2e1fbca123f3955327973c06cbad06e76be306c3446195bc5d74
RedLineStealer
dd66252f052b0068db8bf6f0094ba69aa3f7bd5573d86cc20bb29b32a318c47f
RedLineStealer
fc055241c20a9a62d9711681fb2406dd45cfbf6d3568cdd4d582e052359c83af
RedLineStealer
+ 1'163 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:711 infostealer spyware
Link:
https://tria.ge/reports/221108-1bbslshfh5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine payload
Malware Config
C2 Extraction:
194.110.203.100:32796
Unpacked files
SH256 hash:
17b62d0aa80dfc15d564c3d606ec80dace3a1c4df134ae6022ed31cde2f9be37
MD5 hash:
2e723214eb16d13ae2698c2064c45f97
SHA1 hash:
2c7f5b246658d2a7e5ae8b8b731d6d31e680f894
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/a44a4551-2cf8-4e2f-9bc8-ddf9ebb5c671/
SH256 hash:
17c782177fd60691f9d7b6e59105d282d6c67dc498a0e22b057623298c74bcb6
MD5 hash:
a7b51170196eecc50baf9b558170681c
SHA1 hash:
f1c602d4d8b6d57b85fea0e825364abaf5302e62
Link:
https://www.unpac.me/results/a44a4551-2cf8-4e2f-9bc8-ddf9ebb5c671/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/17c782177fd60691f9d7b6e59105d282d6c67dc498a0e22b057623298c74bcb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/330840/
  
URLhaus
https://urlhaus.abuse.ch/url/2403396/

Comments