MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 233fdd1cc31413c2f799545101decddc609ea38be3299b4bb6ac57450c774ff0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 233fdd1cc31413c2f799545101decddc609ea38be3299b4bb6ac57450c774ff0
SHA3-384 hash: 37a590d42164c9d538358ad1390a12d9f78b9516a79821fbc246a9cb636e0c215fc857724421820e3fc20dd0116a4e3a
SHA1 hash: cb812e8e9e351f57b8499e602d972c05372255af
MD5 hash: bfa665872b30eba3a8fefa20ca9017ba
humanhash: tennessee-orange-social-social
File name:bfa665872b30eba3a8fefa20ca9017ba.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:459'776 bytes
First seen:2022-12-23 04:32:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 83591f62aa1432af9c580674ba7082e0 (12 x Smoke Loader, 4 x RecordBreaker, 3 x Amadey)
ssdeep 12288:XywzA+ch6wtB3kv8MHe2akRR0TCtyYduHNI:bkXhl3e/+2akRR0TCAYdE
TLSH T10CA4E0127290E823CB550674C9BDEBE05AE9F8705911D34A2617772F3BB13D0A47F2BA
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f8fcb4b4b4949dc1 (1 x Smoke Loader, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bfa665872b30eba3a8fefa20ca9017ba.exe
Verdict:
No threats detected
Analysis date:
2022-12-23 04:39:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ae5d0024-f463-4813-81af-b643ea20818a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63a52f800f80231347018d29/reports/870877da-2c84-43a6-90a0-a31a3a4cf45e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6dc0eb44-1f2e-42c8-a849-517299b50a26
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1139804
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/233fdd1cc31413c2f799545101decddc609ea38be3299b4bb6ac57450c774ff0/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2022-12-23 04:33:08 UTC
File Type:
PE (Exe)
Extracted files:
81
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=em752hgdcqj4f54zkriqdxwn3rqj5i4l4muzws5wvrlukddxj7ya._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@vip@2023 infostealer
Link:
https://tria.ge/reports/221223-e6khcafh42/
Behaviour
Program crash
RedLine
RedLine payload
Malware Config
C2 Extraction:
77.73.133.62:22344
Unpacked files
SH256 hash:
22f0da16761e5eb2a884a7663786d12eeb83beb9cdecbce161c5bae26bf2ba67
MD5 hash:
8c4f945acc827f9eec17c12683715605
SHA1 hash:
ad1ec17a59710eb0dff7fe80e59f82b0a1ecca18
Link:
https://www.unpac.me/results/7fa0c12b-e94b-4c51-8437-7f67ce3a8c6a/
SH256 hash:
f10cdaa3e32208a1b908939cffcbb1ff2c9ac5f8bf30864c9c0fd26e8cfc38f6
MD5 hash:
26298459c53aba59568e91f208d681a6
SHA1 hash:
a2aed01156e1ed105a1b51df9dac01f5ba2dfd23
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/7fa0c12b-e94b-4c51-8437-7f67ce3a8c6a/
SH256 hash:
c1ace8e9071ac70b653acd4a338ba860681ac0ac27f06633f8c4ccf5e9d82b13
MD5 hash:
81155679e701382c19cb035d3322f6a7
SHA1 hash:
0bcba6e5d3f1f2088a004c53f876882e25b4eaf2
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/7fa0c12b-e94b-4c51-8437-7f67ce3a8c6a/
SH256 hash:
233fdd1cc31413c2f799545101decddc609ea38be3299b4bb6ac57450c774ff0
MD5 hash:
bfa665872b30eba3a8fefa20ca9017ba
SHA1 hash:
cb812e8e9e351f57b8499e602d972c05372255af
Link:
https://www.unpac.me/results/7fa0c12b-e94b-4c51-8437-7f67ce3a8c6a/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/233fdd1cc314/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/233fdd1cc31413c2f799545101decddc609ea38be3299b4bb6ac57450c774ff0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 233fdd1cc31413c2f799545101decddc609ea38be3299b4bb6ac57450c774ff0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2403396/
  
Delivery method
Distributed via web download

Comments