MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 11 File information Comments

SHA256 hash:	2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955
SHA3-384 hash:	449ae163e34774d62614323f622491a29930b30850a0d02e6706b00348c417d0ba1cc14fd137836da7659cef644be3c6
SHA1 hash:	07676384b7f5ea40ee1dc628086af4bb92109101
MD5 hash:	1ce53a6aa068aee91e137ddd8dc6d205
humanhash:	mirror-kilo-artist-steak
File name:	file
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'390'080 bytes
First seen:	2023-09-18 14:34:08 UTC
Last seen:	2023-09-19 16:54:01 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1e870e4b4919ed70a6295fb438223d93 (5 x RedLineStealer)
ssdeep	24576:Lg1yLp0HmYObxpsiuw/88zk7sEI5tq96:cxHmYObkYvps
Threatray	5 similar samples on MalwareBazaar
TLSH	T1A7557C203D9D8232DDE310BB76DCB827855CE0B4172646E7A6B857FEDE206C16B3D582
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	andretavare5
Tags:	exe RedLineStealer

andretavare5

Sample downloaded from https://vk.com/doc52355237_665851882?hash=PHzUF4J6v2b9GrWXpuJui768p2m0Oye72iJHRdZyzYo&dl=4rYa7J3do5cBfI9g13UXe1ZLbyKAgewCHtqV1jKTlRT&api=1&no_preview=1#qq

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-09-18 14:36:46 UTC

Tags:

stealer redline

Link:

https://app.any.run/tasks/0c5b157b-2961-4147-8deb-092e3f114d55

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/449381/

Detection(s):

SecuriteInfo.com.Trojan.PWS.RedLineNET.7.24871.28248.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Sending a custom TCP request

Creating a file

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Threat level:

5/10

Confidence:

100%

Tags:

control greyware lolbin

Link:

https://www.filescan.io/uploads/65086018f1b40cb0d61e0610/reports/850db45b-d7e4-44ba-849e-ace6fa5fdd43/overview

Verdict:

Malicious

Labled as:

Infostealer/Injection

Link:

https://www.hybrid-analysis.com/sample/2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/590efd00-7447-46fd-96d7-0d2b46a03ebf

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1310111

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2023-09-18 14:35:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fcc4a5iclwde2o3xxen5k5xj2x7igbyk25bpghbhvtahxu73tfkq._file

Verdict:

malicious

RedLineStealer

648aa939a0bb4177d337fe526bbf2b7c70a797fe359c75c7c7658839604a4999

RedLineStealer

69ded352d815114251f0986f1f9d16702f1b33372c23fe8de2cd18ddab231e13

RedLineStealer

8fcff17b725c45f34de3bc8629ab69d811e21ef443ca5fdbf35186d63b909291

RedLineStealer

98ef4e193a3bfbad975da685ebb6d334c214f4fa0f5a2e5420bd9ba6dd2c3f60

RedLineStealer

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:1006 infostealer spyware

Link:

https://tria.ge/reports/230918-rx1jeshh41/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Uses the VBS compiler for execution

RedLine

Malware Config

C2 Extraction:

176.123.9.142:14845

Unpacked files

SH256 hash:

67a04ff65a6c75f92b89263ea96efae791644cbaecb40ea5405501c3f4afda32

MD5 hash:

bbffbd34e64f21e6c0978a1e106c1529

SHA1 hash:

b3c49e2c495bd8bf528adfdce30bc90c93fe01fb

Link:

https://www.unpac.me/results/4390b065-d2a8-4d91-a0d8-2853cfa76a0e/

SH256 hash:

e200f37667683548d2f888f21759ed79c2a758e3322dbdc579aac45887ae9982

MD5 hash:

7390ec23d942b522a4c25145ab8df55a

SHA1 hash:

0a85b1f1f919d291187c7f297306c1bddcc3a86e

Detections:

redline

Link:

https://www.unpac.me/results/4390b065-d2a8-4d91-a0d8-2853cfa76a0e/

Parent samples :

2e2d33e8525c89a48e87802cc4b75e99ce40797826cd8b03bff1dbcbbb344072
27e5e5b03cc0d6a14205c26d63eb7ae0f522f2829f7e94f5524e304147fc1445
ef18e6f222c2c09b7fe21e19ddf9533510deae77e51e63d3c24a9f46e8701c82
2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777
d7090bd33b04f71ac9f01ac7ad9581ea1066a52844b74417d4027ca27475ce72
99550f4b46a2b9b5f6b1e72116e84973ab22cbb2b1f8d2a03dc919db4cb93952
4cd2c0f587430ac6add333d7edf854160e0a4d903edcb7386d6f87d2cbb4b9b5
f028eb7c28f4ad3126755a211a47f206812b182adb4ddb45c225802af1a27eab
2c7e13c2666ebf9ef03bc0d8905e4876d3f3366a6f4ec326880b9db33f197e04
e79fff220e5b914ac939c7db318754c1eef76a534370cf8903f7c4d6960afe58
e9086d430ff782f142e2660ae72526eb2a0468ec0ab01f712f75a07577412017
e6e84acfab6cd72f2d1a8e6847a42324e19669f83a69f51c2d4834eba3b9ee25
a52b1bac7fc89df6491f6528ef4ed0f23b35d7e55b5c133ae6488f3efa80fba5
60447c2bd00cc88d5e91284586fa91357ad5f4b1539949b84b1c204afd456865
3d787306f412bf5a77ec3061ce5acad0606f094734188545c0c493cc3420e3b8
46c2a7ae303529e1b3f695d883c0b0fb0ab0b0cc8bf97a5cf7ae94a4ff20e80c
648aa939a0bb4177d337fe526bbf2b7c70a797fe359c75c7c7658839604a4999
98ef4e193a3bfbad975da685ebb6d334c214f4fa0f5a2e5420bd9ba6dd2c3f60
2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955
dbf79d65990a6cf775a6be1bf5d328ec25783fa5f1a518a0e0c85d455104556a

SH256 hash:

2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955

MD5 hash:

1ce53a6aa068aee91e137ddd8dc6d205

SHA1 hash:

07676384b7f5ea40ee1dc628086af4bb92109101

Link:

https://www.unpac.me/results/4390b065-d2a8-4d91-a0d8-2853cfa76a0e/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2885c075025d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dropped by

PrivateLoader

Delivery method

Distributed via drive-by

Cape

https://www.capesandbox.com/analysis/449381/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample