MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30aa7e9b7b9e08d53966d9a415030aaaf7c7a29d958ae97f53be33de4289828a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments

SHA256 hash:	30aa7e9b7b9e08d53966d9a415030aaaf7c7a29d958ae97f53be33de4289828a
SHA3-384 hash:	abeb5867fe429420602cee92ed184bd83ddfbcd669945eabcf951b0712e176215f0466627fc00f7446e51ae0ad6b2670
SHA1 hash:	de12aecb06f3c89ec7a4783d6998b21c9734bcb8
MD5 hash:	f42b503601a04da4b6fa08f55636f9fa
humanhash:	five-mountain-massachusetts-seventeen
File name:	f42b503601a04da4b6fa08f55636f9fa.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	399'872 bytes
First seen:	2022-05-06 16:25:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8bb30d9f519912fcbc010d3de8eb06b3 (3 x RedLineStealer, 2 x ArkeiStealer)
ssdeep	6144:X/WIKyaXM0ApXMEPQaZLVb5H5vX4sIXxleMn/Iyiga:+IKyQXAeEPl/Nd4s8xlhn/I3
Threatray	5'278 similar samples on MalwareBazaar
TLSH	T13B84E002B691D831D1A30E714870DBA9153FB8929635554FEBA43B3F3E703E16AB9363
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	20e0d8a9a5a5e000 (2 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
193.106.191.190:23196

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.106.191.190:23196	https://threatfox.abuse.ch/ioc/548258/

Intelligence

File Origin

# of uploads :

# of downloads :

257

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

socelars

ID:

File name:

https://cdn.discordapp.com/attachments/971594184983203922/972133312887922699/Setup.zip?file=Ready%21.zip

Verdict:

Malicious activity

Analysis date:

2022-05-06 15:24:23 UTC

Tags:

evasion trojan socelars stealer loader opendir rat redline ransomware stop hiloti

Link:

https://app.any.run/tasks/c22cd927-359d-47ae-bc9d-00e6da346dbc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/269156/

Detection(s):

Win.Malware.Filerepmalware-9941437-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/16555/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed pandora

Link:

https://www.filescan.io/uploads/62754c6dbe0219041a7569c0/reports/35f66e2f-75b9-4c59-a1eb-7c1b7e1386b6/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8ce02a61-e30f-4fa7-a12d-55dcb930ddaf

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/989205

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/30aa7e9b7b9e08d53966d9a415030aaaf7c7a29d958ae97f53be33de4289828a/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2022-05-06 16:26:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 42 (54.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gcvh5g33tyenkolg3gsbkaykvl34piu5swfos72txyz54qujqkfa._file

Verdict:

malicious

RedLineStealer

1a12ff0fc0c9ffc1d06b2f448eaa7ce816bfbc15614fb65c4157bd90e2fa4f88

RedLineStealer

47bd7a34a281905d87836b96bd195bda95cd0a6d8a98a48acfb9773d0b67e820

RedLineStealer

6347eda7821b2807e969568f9125af76656c78f222ccf221efa4b8b2a23adf0e

RedLineStealer

8e8f1b702c2fc78e020c6025ae7a9044512e8bca0af5c633dd21fecf2a7ecfd4

RedLineStealer

f1a4237dfd7bce16e02e096bebeb956ca962bab0fd630adf94813aadc0ef44dc

RedLineStealer

+ 5'268 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220506-txhdysabe3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Unpacked files

SH256 hash:

9e8311bec1016714cd42f213b2dfa34f6289e79d68ba4d8b318f2e6b3d3d4534

MD5 hash:

e193fd1aac79751caa70881c3f8a6ee1

SHA1 hash:

c4240847913391dc16eafe6e7a85dfa74d3de706

Link:

https://www.unpac.me/results/6a3697ff-fef6-43c6-a6e2-c0489a7a2994/

SH256 hash:

ee226c68a7381f58c3a9549b07208c97d27410de2c96af5a4c4b56faef10f5fb

MD5 hash:

125ba3a5d30471d100afc886d4abb864

SHA1 hash:

8b92bc1d586a325a81af9fd959a560d7d1f2d411

Link:

https://www.unpac.me/results/6a3697ff-fef6-43c6-a6e2-c0489a7a2994/

SH256 hash:

2f1886b2fca83c1fab8c720629328df83006c9f1737917ed2defed9b28965012

MD5 hash:

3b33b6d0b3b715f189e88a040fd4fc94

SHA1 hash:

27fcb465517480c70732cec1c0ea0e4093bfabdf

Link:

https://www.unpac.me/results/6a3697ff-fef6-43c6-a6e2-c0489a7a2994/

SH256 hash:

30aa7e9b7b9e08d53966d9a415030aaaf7c7a29d958ae97f53be33de4289828a

MD5 hash:

f42b503601a04da4b6fa08f55636f9fa

SHA1 hash:

de12aecb06f3c89ec7a4783d6998b21c9734bcb8

Link:

https://www.unpac.me/results/6a3697ff-fef6-43c6-a6e2-c0489a7a2994/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/30aa7e9b7b9e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/30aa7e9b7b9e08d53966d9a415030aaaf7c7a29d958ae97f53be33de4289828a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.