MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
SHA3-384 hash: 3c48cc6e0c55ab0bd9277587598016bf92338c4520fa84318ec566722e29f55b3286f7a3c505cd50d32c3fc65ba0e7cf
SHA1 hash: d34d9f5e8269a7535e8d461213b1cc10bf91ded9
MD5 hash: c88684792ace21a20a82333f91a39251
humanhash: early-pennsylvania-coffee-happy
File name:c88684792ace21a20a82333f91a39251
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'451'904 bytes
First seen:2023-07-24 15:58:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 99618c39aafbf01419fbcd53cea0e110 (10 x RedLineStealer)
ssdeep 49152:25PMZ6GWmN4S8Fv0cHuB0F/kOyMNrInH5TVHPNj+:OmNH8xb00FEHbPNj
Threatray 2'091 similar samples on MalwareBazaar
TLSH T172F5F26038D18331DDF230BDC6DDBA15427EA0E00B22A6CB56CB86FD8F255D9AB35593
TrID 56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.1% (.EXE) Win32 Executable (generic) (4505/5/1)
3.7% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
2c30831eb76b914da639870474874647.exe
Verdict:
Malicious activity
Analysis date:
2023-07-24 15:08:00 UTC
Tags:
loader smoke trojan amadey rat redline lumma
Link:
https://app.any.run/tasks/da6138cb-f63d-46dc-9135-cc456a082904

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/431359/
Detection(s):
SecuriteInfo.com.Trojan.Heur2.sNW@I9ItEdm.21128.17688.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Searching for the window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f33b344-f044-4f45-b9c4-5f1ca1ef5644
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1278479
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1278479 Sample: 5BgqnntU7m.exe Startdate: 24/07/2023 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 6 other signatures 2->39 7 5BgqnntU7m.exe 1 2->7         started        process3 signatures4 55 Writes to foreign memory regions 7->55 57 Allocates memory in foreign processes 7->57 59 Injects a PE file into a foreign processes 7->59 10 AppLaunch.exe 4 7->10         started        13 WerFault.exe 24 9 7->13         started        15 conhost.exe 7->15         started        process5 file6 23 C:\Users\user\AppData\Roaming\...\lux3.exe, PE32 10->23 dropped 25 C:\Users\user\AppData\...\@ytlogsbot.exe, PE32 10->25 dropped 17 lux3.exe 5 10->17         started        21 @ytlogsbot.exe 5 10->21         started        27 C:\ProgramData\Microsoft\...\Report.wer, Unicode 13->27 dropped process7 dnsIp8 29 176.123.9.142, 14845, 49705 ALEXHOSTMD Moldova Republic of 17->29 41 Antivirus detection for dropped file 17->41 43 Multi AV Scanner detection for dropped file 17->43 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->45 47 Tries to steal Crypto Currency Wallets 17->47 31 176.123.9.85, 16482, 49706 ALEXHOSTMD Moldova Republic of 21->31 49 Machine Learning detection for dropped file 21->49 51 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->51 53 Tries to harvest and steal browser information (history, passwords, etc) 21->53 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a/
Threat name:
Win32.Trojan.RedLineSteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-24 15:59:09 UTC
File Type:
PE (Exe)
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcrmwazecdizc6frmnnci3ytazsevqiihd2eksk3tzl7343rry5a._file
Verdict:
malicious
Similar samples:
169e01599ade6b92e0a47abbb8ad87b26b72c43ad7d6e9b9ea604ce59961d673
RedLineStealer
28120e30e6493e67c89ef159d2d1b2866cc05ebc0be35758023feef924eb5d1b
RedLineStealer
2986955a86572ace49ad3773a3e1ddb742ade6a5d0b09e9f4597bba2477a1465
RedLineStealer
2f94e4ce7f8ee0d584b776988ac0dd80df820f5a44d866271efce73c6ad84fc6
RedLineStealer
44c6ed2ddb5e2077c153de0a299dcbff82ba1d2a9f304c0e4fed47496ba82af7
RedLineStealer
5d243ded181eefcd0d051a13f2ba7845223b576d6c8f93777552cf252e28bc90
RedLineStealer
6f03dfd71abd06402371157eac912ffeae7871a6d93b8d2dad3242ae59644fcf
RedLineStealer
861cfaafee3a7a3a67bf5d707b193c7396811c8c7c22136886e2bb0513e4fd66
RedLineStealer
ddd8aa44e44b27ae1604042ccd9564ab5bc44d72b680293856057995f154cbc9
RedLineStealer
+ 2'081 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@ytlogsbot botnet:lux3 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230724-te3xyafg4s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
176.123.9.85:16482
176.123.9.142:14845
Unpacked files
SH256 hash:
318fb81812de16e80a2cfc90895004cb03530e49d62d360915661fcacc390da9
MD5 hash:
c663260681134d0f6811806093ec7f8c
SHA1 hash:
9643578b145e79481e35411ee4eb3a5baf30f8d6
Link:
https://www.unpac.me/results/a82fe652-8884-4e9a-ac0d-d2a744cc44e7/
SH256 hash:
0c3ba1ed7210694ecbac0028c6ecc8508e80667ef336c321ba3e1ade510371b6
MD5 hash:
7d4a62d54c733ef9752232e3334c2eee
SHA1 hash:
db0520a08226dc0ab4fd879fd6690c32c816a927
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/a82fe652-8884-4e9a-ac0d-d2a744cc44e7/
Parent samples :
2f94e4ce7f8ee0d584b776988ac0dd80df820f5a44d866271efce73c6ad84fc6
861cfaafee3a7a3a67bf5d707b193c7396811c8c7c22136886e2bb0513e4fd66
28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
e347d2c37800e83e391725e58e82a1901d3b91c04f4707bc340499bf2e6a6fe1
7b3a28bfe1eb241dd539336313198a6684bcbef1905349b8b0859de555bdf3dc
8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d
4e6015f1e7c8790a2907de407d2ea9e14ccc04e925c81607fb815bd73c372389
854929dccfca0bc24198bb737a81a8d74b2bc924049167b8ed6ad8e96a75610b
0182e73c39240c0e660bbdd4262209f08d767562d4794b7ed5e36a4d4f36b409
b08a80b3d8ed960304fd66086b3c2cf13745118e04d6db99f9b0ff68b869b4cf
0c3419ff8ddebff25027285ff876f30569e7915b993930411b230cfbf3e52214
0f2f61669d3bc852e0defe69777a70627ae072b167425a64f4c88ac9ca84389c
3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
51f914de76eac9e6bce5b2d3efb1d00a240097e71f3f042303b16917702f64ed
e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a
2f25790b3368b6afd35007dfe873e90a288cfce9d19758756b71fa6952a675f2
SH256 hash:
f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808
MD5 hash:
dc0d6257af6ac44eb10333a282b0f738
SHA1 hash:
a749e2c90b313174a91a6e51db6bc8e6dc00f37e
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/a82fe652-8884-4e9a-ac0d-d2a744cc44e7/
Parent samples :
030ee4d82518139a21800e8c6946f46cc251821e9a738a78cfca30a18f0e98a9
fd31a663216bfb8143db8ea956edda60157228e4e26abd15724d28e34f435c66
f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808
2f94e4ce7f8ee0d584b776988ac0dd80df820f5a44d866271efce73c6ad84fc6
861cfaafee3a7a3a67bf5d707b193c7396811c8c7c22136886e2bb0513e4fd66
28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
e347d2c37800e83e391725e58e82a1901d3b91c04f4707bc340499bf2e6a6fe1
SH256 hash:
960649ef90d8f090e9c9ea10c319eb178709811c62a845318989f1ae6da834c5
MD5 hash:
bb3ba37ce860bab966f7e189b4afd030
SHA1 hash:
5afe199166be0808968167dd130d174d435f35b2
Link:
https://www.unpac.me/results/a82fe652-8884-4e9a-ac0d-d2a744cc44e7/
SH256 hash:
7c533374288bae24f70e51c9b70c372e9d91fea2c51ce84903f47ea769fba83f
MD5 hash:
936cb3023cd500e07e9ad5dda9996c3f
SHA1 hash:
5772bd98e8da65cb1339e45074b0a6eaf07219a6
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/a82fe652-8884-4e9a-ac0d-d2a744cc44e7/
Parent samples :
d8244ef0cb7ee70181f80484cff739b6f1458a2e9f2836ad00f445c3b863ba25
c4d252efb23f087a2c2efdb8bc64b97a9976c0f85995a50e18791f4538fac454
4a9c93e088da7f15b571b3595624ae59f112d3f532c8265178d4cc71f7ddd8b6
2d873fb5e5df1ecafccb3eeaa6dc1835676d7f43938ff37a623285a086d6208d
187a40c80f0e837cdce06aae645e185e8da0b82f7ef922f83cff3e4fa27ac421
3c979ae1af88397dc5be34fea28050d85cd283898d71e52c8ad1db05c407458b
b6f77ab64fad140fa89c1ce71cff87397de1e28bfa747690ddb5b28a7e46f461
12e2b32428e957fdb6bc42d0e99a84a2a4e9dde411b356a0ff45bf6b66dd9d33
705dae41f74ff7fa9f5d4474d3474422d69e20bdebb9c36c020978de8ce48368
625423357c26d7445624d49b25dd0debe94b586f08cb2afb746d1498207477a5
67b9b74f647846d67ef5be1e4aba44e74cc62e9e401ca9f8e5bb695daa15e611
31b8115712aa50566e40a5246b9415adb02bb49679ddee79e427869c607838cb
277a999bab7bdb1a609efaf82a6c33a871c8c5334cec9c48241878d060540136
3a054bcc44b57c0cc62512768e7cfe21159d0530d775ae7d04c5b4eeea17c117
b7cb338abb490b1cc110d044049d5b5402bdaf411989d84bd739b7fd6974571f
824802b8de1d5007ebfd0449d1131ef31aec0b5f84fc39fe721fecb9b116007f
d1e74b5540f6ee93076ebff16db8593decd2364f4a4465d4ef7f4087f7c8119c
0017cc9e58298216af63de0f6bbb0a4a369d4b96a5dc52f6f25d47867a1ca346
665a12c39806edc87811291d7c054ccd07ada0f7da775cf90b6473b2a4457586
b106631de5708f0c7db74edc5956c0b438759a051a4624664124b76ee2f29356
fc412bb40a7d2ca18ec93170fb61b7e8db762db7415592f19bc367402f6d550e
73482d57d8d95b8f24345ab5a962a845f0b05f455ce4037a716df4ae2ff275c0
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb
3b67ac2053cfcb67f4034907cf81e72d93541e06f86ab3ac73130c4036c07651
7c533374288bae24f70e51c9b70c372e9d91fea2c51ce84903f47ea769fba83f
2f94e4ce7f8ee0d584b776988ac0dd80df820f5a44d866271efce73c6ad84fc6
861cfaafee3a7a3a67bf5d707b193c7396811c8c7c22136886e2bb0513e4fd66
28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
e347d2c37800e83e391725e58e82a1901d3b91c04f4707bc340499bf2e6a6fe1
SH256 hash:
28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
MD5 hash:
c88684792ace21a20a82333f91a39251
SHA1 hash:
d34d9f5e8269a7535e8d461213b1cc10bf91ded9
Link:
https://www.unpac.me/results/a82fe652-8884-4e9a-ac0d-d2a744cc44e7/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/28a2cb032410/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2689017/
Cape
Cape
https://www.capesandbox.com/analysis/431359/

Comments


Avatar
zbet commented on 2023-07-24 15:58:52 UTC

url : hxxp://5.42.92.67/lend/0x8mompdsnjum.exe