MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2565e68053f55100b72c5c1287cd5ea542653ad6a0ddcaa433a8775a01164c0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 1 File information Comments

SHA256 hash:	2565e68053f55100b72c5c1287cd5ea542653ad6a0ddcaa433a8775a01164c0f
SHA3-384 hash:	f3e527046b86a54081e406dda58fb6c52733b0d25f5726820366b27a519c556a5b518496f737e535eb44b69ea62ad124
SHA1 hash:	4d9243e3abb4865703b0379ef8e80035be459674
MD5 hash:	4241afd928b4be2124d57bf0344cb69d
humanhash:	speaker-indigo-table-twelve
File name:	2565e68053f55100b72c5c1287cd5ea542653ad6a0ddc.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'517'512 bytes
First seen:	2022-08-24 03:35:33 UTC
Last seen:	2022-08-24 04:33:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	eb48d8027f9b4a42f8506a3ba35f43e8 (2 x RedLineStealer)
ssdeep	24576:K9+dUGpieIJadLL7Y/04m3IzNFq3uAEOOnCs8yqzj2WCl/pPD79HPSfoOM4dg4ay:K9+dUGpHI6LLLIIuAEgzH6p9HW9lr
TLSH	T193651279CF969105D7170A38F6899E86D662D8C086019F971F5E2F0A0FF6AF80E3C197
TrID	38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 13.0% (.EXE) Win64 Executable (generic) (10523/12/4) 8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	10cccccccccce800 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer signed

Code Signing Certificate

Organisation:	*.vocabulary.com
Issuer:	Amazon
Algorithm:	sha256WithRSAEncryption
Valid from:	2021-10-22T00:00:00Z
Valid to:	2022-11-19T23:59:59Z
Serial number:	0497288bc1b3149825a4f2af1bdfd8f1
Intelligence:	2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	df1ef268c106a699ef6e1657766685c8f5195c391863df804cd6bb5d50d26f3c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

abuse_ch

RedLineStealer C2:
37.139.129.226:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
37.139.129.226:81	https://threatfox.abuse.ch/ioc/844917/

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

installer.exe

Verdict:

Malicious activity

Analysis date:

2022-08-23 23:13:22 UTC

Tags:

trojan evasion redline opendir socelars stealer loader rat

Link:

https://app.any.run/tasks/0dc9f4ce-fb38-4be3-b2b4-d1d6d18784f8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/300699/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.3177.22451.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a window

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/29869/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/63059cdfb6f2a6ec1d60d655/reports/0782f060-2cf3-4db9-8c25-aa48a3b611d5/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1dd35b7c-9ab0-4d65-94e1-cfcad2b45caa

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1056716

Signature

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redline

Link:

https://mwdb.cert.pl/sample/2565e68053f55100b72c5c1287cd5ea542653ad6a0ddcaa433a8775a01164c0f/

Threat name:

Win32.Trojan.CrypterX

Status:

Malicious

First seen:

2022-08-23 19:04:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

11 of 26 (42.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=evs6nact6viqbnzmlqjiptk6uvbgkowwudo4vjbtvb3vuaiwjqhq._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:2308inst_rozen discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220824-d5xkvaffbm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

serverdataorg.xyz:81

Unpacked files

SH256 hash:

2565e68053f55100b72c5c1287cd5ea542653ad6a0ddcaa433a8775a01164c0f

MD5 hash:

4241afd928b4be2124d57bf0344cb69d

SHA1 hash:

4d9243e3abb4865703b0379ef8e80035be459674

Link:

https://www.unpac.me/results/cd78a77b-adf1-4a0e-a369-aa33a84662a5/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2565e68053f5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2565e68053f55100b72c5c1287cd5ea542653ad6a0ddcaa433a8775a01164c0f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.