MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ee16051fc66e2eaf8662b1efae4040d54ab9257b8daa0f5849a96e50839bd8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ee16051fc66e2eaf8662b1efae4040d54ab9257b8daa0f5849a96e50839bd8b
SHA3-384 hash: c417d2ba4ae4150982289bdd39b027346eac537bc866a4d992e62907bcfb3042a841e0d336ab6a583e32f5e4d37a1d84
SHA1 hash: 57e969a204b4a8a33fd1dd00a1f94717dba8ac8b
MD5 hash: 6bdc12a959eb8c6d21eae11af4fd57c3
humanhash: juliet-romeo-august-jig
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:5'217'584 bytes
First seen:2022-09-02 14:11:20 UTC
Last seen:2022-09-03 12:35:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 172750858dcc0719eed08c952858023c (117 x RedLineStealer, 3 x N-W0rm, 1 x AsyncRAT)
ssdeep 98304:NWNd6DP4nR72c0Uy5peDiib8aoht+0Ckyd67YLryqSqMhzrA5aDBemsIKkX:Ngba5kWs8aEDydcYvyqUzrDAM
TLSH T1C536123712750216D0E2CC3B453B7DB979F5132A1B42A8FE658DADC51A3A5E0F723A83
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon cc94545d5918ccce (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:jbl Słuchawki nauszne JBL LIVE 900 Biały
Issuer:jbl Słuchawki nauszne JBL LIVE 900 Biały
Algorithm:sha1WithRSAEncryption
Valid from:2022-08-31T14:24:57Z
Valid to:2032-09-01T14:24:57Z
Serial number: 5b7d417bace4f29046b36b96ee9e7d26
Intelligence: 7 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 5d26f9c940f264d682735cec8f0a28e115e930678a6e508f59de16c1ca1164e9
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://vk.com/doc743379129_647609509?hash=11W4osvbUfl8Z1nuuFLLnFR6skdzKZAGl8V3vCNpR0s&dl=G42DGMZXHEYTEOI:1662126873:ci2nbDnXYQRRSRZG3zbZYTy9E2tUzNwe3oPH0L02ZB8&api=1&no_preview=1#xxx

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.137.192.41:18114 https://threatfox.abuse.ch/ioc/847455/

Intelligence

File Origin
# of uploads :
14
# of downloads :
447
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-09-02 14:18:42 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/48815f01-da89-4c63-965f-a7dedd2aec00

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/307472/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the system32 subdirectories
Creating a window
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm overlay packed
Link:
https://www.filescan.io/uploads/63120fb0fbf1afa49280e3ac/reports/2909f551-3483-4211-8bfc-22e42f978f28/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/dcbe7793-82f9-45fd-9f39-01e73f03f2ad
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1064185
Signature
Found many strings related to Crypto-Wallets (likely being stolen)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ee16051fc66e2eaf8662b1efae4040d54ab9257b8daa0f5849a96e50839bd8b/
Threat name:
ByteCode-MSIL.Trojan.Redlinestealer
Create hunting rule
Status:
Malicious
First seen:
2022-09-02 14:12:12 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
15 of 40 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f3qwaup4m3rov6dgfmppvzaebvkkxesxxdnkb5metklokcbzxwfq._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220902-rhtsbsfagk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Unpacked files
SH256 hash:
043af0c1f65b28c852d13ccd7c18356413e6735644be9dd891ed2b2b1c3d6fe9
MD5 hash:
989872b5ac5b86e6124c5006bf62ed68
SHA1 hash:
58a42fb2fd58e987a3531fed930065ed2f7e8ffe
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/a5597632-f9f8-42ab-b842-130eb3091dd8/
SH256 hash:
04535c53f5ba4f9791bc9d1231dc8e179a10456ef9a13fb859fa40aa0cfa4edf
MD5 hash:
86c497c80c791f9ccf0fc5ce6c017b94
SHA1 hash:
4e55999c2287d7d65209e03a101386b332d5bc68
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/a5597632-f9f8-42ab-b842-130eb3091dd8/
SH256 hash:
2ee16051fc66e2eaf8662b1efae4040d54ab9257b8daa0f5849a96e50839bd8b
MD5 hash:
6bdc12a959eb8c6d21eae11af4fd57c3
SHA1 hash:
57e969a204b4a8a33fd1dd00a1f94717dba8ac8b
Link:
https://www.unpac.me/results/a5597632-f9f8-42ab-b842-130eb3091dd8/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2ee16051fc66/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ee16051fc66e2eaf8662b1efae4040d54ab9257b8daa0f5849a96e50839bd8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/307472/

Comments