MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments 1

SHA256 hash:	282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0
SHA3-384 hash:	717fb98050b124e866b53143a618a2e20d450e425169930f635c859578fc6af659f03f93c4affc260edc0a887c38b2e0
SHA1 hash:	6dd8a99b8755c447de7da1e295be51fb35ae80e3
MD5 hash:	3bda907ee07038864f137c71376b2e63
humanhash:	echo-carbon-friend-solar
File name:	3bda907ee07038864f137c71376b2e63
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	313'856 bytes
First seen:	2023-02-07 10:57:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	01b655af6d395e5ede880ec579b9fddb (11 x RedLineStealer, 3 x Smoke Loader, 3 x Tofsee)
ssdeep	6144:LHz4kzwLBC/asDSHAn+4+3UPemVnU38JWGKgIghQg6Fr:LHz4kzwA/aZAn+4fem1o8JWVgh9E
TLSH	T1CF64F1263690C072C56B59301824EB95BFBEB93115B5C54BB7E813AEDF307D09A7630B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	916a6e6a6a6a6e70 (2 x RedLineStealer, 1 x Smoke Loader, 1 x LaplasClipper)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

223

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

3bda907ee07038864f137c71376b2e63

Verdict:

Malicious activity

Analysis date:

2023-02-07 10:58:04 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/27f1034f-9acd-4af2-bb30-a6f8bd05181e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/361332/

Detection(s):

SecuriteInfo.com.MSIL-56.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Connecting to a non-recommended domain

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/63e22ebc96add6d1cf49e8ae/reports/eebdb3d5-bfa8-4686-a188-e4346d7f9fd1/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7787ff44-0d66-48ee-b8d0-551c3964b01c

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1167590

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2023-02-07 10:58:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=faxnpdyqroze5gx3mp4sko4no4po3ensu2zqrhpjjkco4cji23ya._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:new discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230207-m2tt8abc34/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

82.115.223.193:43389

Unpacked files

SH256 hash:

b97fb77a7685d303c7656fd1cd2085776224a962df22f45b1c6bd728300d120b

MD5 hash:

97728ce015f78e488f80831524ef9891

SHA1 hash:

e72dea77871ecea444ad9c77a102f33d8085dfc5

Detections:

redline

Link:

https://www.unpac.me/results/e9011482-9f6e-4037-be57-7c44117d64ea/

Parent samples :

ee833fc2248cb93a2b6b2090808c2c9dfc63ba3b7742c4f8269635411030f7b6
2b49784b561617cf947f55faf2692dcd97960f92e50dc9a1eeb926d534d56e77
4250602036e16dedef56f32955aa4611628e3a87fa53bf2e23e30ddd8b4bd8fd
57b5ae8759f3965f4a42268f53a27c1aaf15be3e29df9c18af552d74d4fd0f93
cb383f5456128b82b841492d8b0264e196d6c9fd742c9690fbf816d8d59c4287
55d930de42a7b77be3ce4fc6c7750f9554aeec874b883ea43e7a5dc6fd97e5b9
282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0
8faf2d0e248c0775f91d534325ad36c730f45e3e2717752d12fc5eb99dff6110
35cd53ed6908463b7904ce70f1a278f10ecc0d6517897624e3656091dab5f0cb
0e8849fae3014fbbf9e1c4e72d1022b8887665eadc0bc019860e2e90d7c7b146

SH256 hash:

1057452131b0167e6d738f7dc088ffaadc80964ddb659b645fd9b2acfbda2d7c

MD5 hash:

a0ffc8e3693c8a3fefa1a5799bd69d65

SHA1 hash:

da4fe91e5c1e04850addca09fa6f8c67adb69c1c

Link:

https://www.unpac.me/results/e9011482-9f6e-4037-be57-7c44117d64ea/

SH256 hash:

8bde4031f9cc8f17a16ed9cea0c0fc68c558906c3bd2e46b7d6a6598f8f46a0a

MD5 hash:

a1e7b9313d2d61fbc6c538d75ea3dd40

SHA1 hash:

3c03d09927b71efdf268589009f36bb023f4b81b

Detections:

redline

Link:

https://www.unpac.me/results/e9011482-9f6e-4037-be57-7c44117d64ea/

Parent samples :

ee833fc2248cb93a2b6b2090808c2c9dfc63ba3b7742c4f8269635411030f7b6
282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0
35cd53ed6908463b7904ce70f1a278f10ecc0d6517897624e3656091dab5f0cb

SH256 hash:

282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0

MD5 hash:

3bda907ee07038864f137c71376b2e63

SHA1 hash:

6dd8a99b8755c447de7da1e295be51fb35ae80e3

Link:

https://www.unpac.me/results/e9011482-9f6e-4037-be57-7c44117d64ea/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.