MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22ec1d3d593ae739da779e653a28507275feb115e007cfe069f53c71247468f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22ec1d3d593ae739da779e653a28507275feb115e007cfe069f53c71247468f3
SHA3-384 hash: 5f1176e7efd4b363d86d4d6d0fe9deb89e71119705d8ee0f9a9d1a761d3c53eb85bda82a395d6d763d586628adbe10c0
SHA1 hash: e67b939f0dce868f192dbe219ba51cea2d5b4613
MD5 hash: 5012f53af153342a9a3f37e8ce38cedd
humanhash: georgia-iowa-uniform-bravo
File name:5012f53af153342a9a3f37e8ce38cedd.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:253'440 bytes
First seen:2021-08-18 19:20:36 UTC
Last seen:2021-08-18 19:45:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d14e6f286b56e073587d660c9cc6ef7f (7 x RedLineStealer, 3 x Amadey, 1 x 1xxbot)
ssdeep 6144:Wqd/DNSDaeyymV+nrvVX/kxq9fk6x2XYd:J1NlIxvMqr
Threatray 4'958 similar samples on MalwareBazaar
TLSH T16944F1217090C9B3C76302713CD6B6E1746AFFE16B7555433BA92B2F2E312815A3AF52
dhash icon 1072c093b0381902 (22 x RedLineStealer, 7 x RaccoonStealer, 4 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.29:8889

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.29:8889 https://threatfox.abuse.ch/ioc/191954/

Intelligence

File Origin
# of uploads :
2
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5012f53af153342a9a3f37e8ce38cedd.exe
Verdict:
Malicious activity
Analysis date:
2021-08-18 19:25:43 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/b2ff8c13-60e2-4b5f-a099-144aee3322bc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180438/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.13399.30395.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/426aa9e9-a8e9-402b-90f9-a83175bac278
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/835338
Signature
Found malware configuration
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22ec1d3d593ae739da779e653a28507275feb115e007cfe069f53c71247468f3/
Threat name:
Win32.Infostealer.RedLine
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 19:21:17 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=elwb2pkzhltttwtxtzstukcqoj275miv4ad47ydj6u6hcjdundzq._file
Verdict:
malicious
Similar samples:
09d58d081dd9364e99857ac273d52a17a0473cc64e64d0e15b2b9b2f67ef2d49
RedLineStealer
4023763ad7b1f3cae1395dcfbfb15317c006526c355914ecf7d8506696e3b1ce
RedLineStealer
5a08fbf3635e557182b59aba6d21a974aa712ea0e90b023cbf76519ea52959aa
RedLineStealer
5cce9b6a71a53d6d8f9cb245ee9153618ed3c41b6cf3a9319e6d484c9110fc64
RedLineStealer
637a0494e576015bdbc53a9a3d5efd6ed2cac129facef169a06ed4f2d07188d2
RedLineStealer
8498f560c45b7d2db3427aaf5a481a4e584a1aa8f59767147e895b60e08286cf
RedLineStealer
b9a12e40fe14966bea176d4eb5c96ca19b80982eeb08636711b53bf4fdecfdf1
RedLineStealer
ebfe4a01a842ddcf434e44a288773454c4c5c35602a5fba3a31e47ff010a1314
RedLineStealer
+ 4'948 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210818-trypl2v55e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.215.113.29:8889
Unpacked files
SH256 hash:
9478069a6075be715c8522628753d156c10816fc3b5f89eb98aa160b34db92e1
MD5 hash:
792f7ce7b919e8cd99eecd61e6e04c78
SHA1 hash:
c902c51b212fbbc5640b3636a67f04abd7cfc23d
Link:
https://www.unpac.me/results/5082df46-3acc-47d1-9d56-ec1bf151c904/
SH256 hash:
c20bf9a202b0a3998821f446a9ba4445ad61f6f9db7ed4f196f4d52babf18169
MD5 hash:
a24c2c9d2094c15460c48f78ad3d4012
SHA1 hash:
aa7f216f323259c42930f67c1d828499f4d71fba
Link:
https://www.unpac.me/results/5082df46-3acc-47d1-9d56-ec1bf151c904/
SH256 hash:
6beea74184d76a8101e9eccc429a85ccd579bffe86013c6a72db1666291a9fad
MD5 hash:
6bff04629d81b31018f1f09094b10dc4
SHA1 hash:
1705f121a0ebd3cc6e843423d6507025fdd27fe6
Link:
https://www.unpac.me/results/5082df46-3acc-47d1-9d56-ec1bf151c904/
SH256 hash:
22ec1d3d593ae739da779e653a28507275feb115e007cfe069f53c71247468f3
MD5 hash:
5012f53af153342a9a3f37e8ce38cedd
SHA1 hash:
e67b939f0dce868f192dbe219ba51cea2d5b4613
Link:
https://www.unpac.me/results/5082df46-3acc-47d1-9d56-ec1bf151c904/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22ec1d3d593ae739da779e653a28507275feb115e007cfe069f53c71247468f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 22ec1d3d593ae739da779e653a28507275feb115e007cfe069f53c71247468f3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1533784/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/180438/

Comments