MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0
SHA3-384 hash: 913350d409a941ecb8f1bc0ec43440dae6eb4380257d7a3a773775fef66a3fde356ad218dc8aedf1acc515a84357dd19
SHA1 hash: d5bb00bdcb445dff145517d9711f3b3ad46afab1
MD5 hash: 08c28324179b6bb20cee61bd8ea4707a
humanhash: spring-salami-butter-monkey
File name:08c28324179b6bb20cee61bd8ea4707a.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:276'292 bytes
First seen:2023-06-23 08:46:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00ec575575de41d0435d66fe37ebf010 (200 x RedLineStealer, 84 x Amadey)
ssdeep 6144:70ueQ8igt0poiRG/XvLNUgYhuE22aQJQmp:70ueIgtAoiRG/fSvSQJQmp
Threatray 827 similar samples on MalwareBazaar
TLSH T146443BFB52D1D460DD0FA4B02C6AE1BDEE31B461DEA284CA19BE0952D3530E4BCE758D
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
83.97.73.131:19071

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
08c28324179b6bb20cee61bd8ea4707a.exe
Verdict:
Malicious activity
Analysis date:
2023-06-23 08:48:07 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/d130445d-50c8-4c16-926b-a7999bb1a18c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/402007/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.32363.26792.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/92350/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
SystemUptime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/64955c075012c41b6e669038/reports/2cb8a3e6-8ca8-4309-b5be-ea41bb0b5f18/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5102f765-3b5e-4027-a292-67a8e97f35e8
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1260264
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-06-23 08:47:07 UTC
File Type:
PE (Exe)
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gfw4rsz3zcdprjbemmemt4tcbwf2lciwmybedcmhepe2gglcytqa._file
Verdict:
malicious
Similar samples:
2d75c6c5fd7e960e7ad6db549aa94a859a9adb6c7fe519163ded7f2f4926e558
RedLineStealer
41f6b8bb06f5551cb02b8fc1a49e97b377a0e46db6f66c6de45fc85195cbe012
RedLineStealer
5778677b27049800f124999089877df3718d68c909eb08cca84644c353b4b925
RedLineStealer
5c671a7a409c3a6f2d041017fc2a801907248dad36be8041050fae4a6c34a4fd
RedLineStealer
90c43c06497262ab440c59fb684b398b5cc1cfca79b8383c402043df3b615553
RedLineStealer
9e60f719f6c1ae293ad593dc093e5872bc1a7df340a54527e7a1c9186ad66712
RedLineStealer
9f541515773e1630bdbcf4490cfd6b4e7998f3ef2e8d013dfd0eefdc08315642
RedLineStealer
a506164efe62709bde219f076979078ffd7c73f0755afe8349906861040b4899
RedLineStealer
b96d28c0c43a8bc8c124dfbd69b03e2ea83c698024a7bd4e3770a2465e425c44
RedLineStealer
cde7d34e8a6fdf62f45f927164eeebb49f512d78806d1ddd41dcbc00aacb3b51
RedLineStealer
+ 817 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:drake discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230623-kpv6eaeg8t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
83.97.73.131:19071
Unpacked files
SH256 hash:
94d4de635bf8ad35e75209fcb11e2258d717d281702a1eb5cfef598d937ec71d
MD5 hash:
ef9926096b014236a8f52dfd908bf92e
SHA1 hash:
fdd39504d1c3afd021797fa9ae1ea42b3fa99e53
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/b9a155b1-1165-454c-a56c-9007a4f80277/
Parent samples :
40bbd979bcd506f0cff972c4f29914c3ae1f55210607ca30dc07427d481e7960
86674ec221ca410677a2016269365c8363a861681329891922d2d97a478f3da2
495a33650e2f846aefe615a69010703bf0b476de82e5589ebe8b1b01cee60651
eb85ef4a0eb3677f91b8f85f3367a9fbf2c16b179170d7cf99565ee314944107
2ccfb437fd19456a0d52838663a6f40b24c322ed2d4f34b88b6fe6f3c7bccc85
6fc2953d20ba9cf2d509eeb08544f7b36f2578d2560af2e71dc2fc6a7f82bb11
054f9326f802b5d899324d452292f32e9c16a68a759e8437e170ef0ebec48401
65a656d8fcd62e43d9a01fa3b778901ce779849f2fa38f5965d2e212bba23e0f
cc39c0fa08cc5c0dc454f4b2d9f93abb6f15938be97d5372c732c3bbee4ed424
fc0a50ec189b63649ff733fb32955f7ef800a453f322f7fe5e16ad952178ec52
5753cc6ed646f477448e8e0f41e65d3348deeb301c45eee47744ee41483e7a44
d7dde8dee8de0c00c4ccc0ffbf63b85721f6d86debe26bca22162662824d1c16
7daafd589963ecb11194e8f4398e244b721720125678823eb1c6b9924ae06b37
b6dcdc6a8ee3fcb6c24128a13d0d1ff10b29e18bad3ef1a279ba7751adaf2801
a5a5076eeab65c1e316b67e2741d2cbb94afb702269f895b07a541504ad69d0c
eed2efb4c4e0b1f65fb0930845b30ddf84ee71b8ea7a1efdbb80d4ac342bb9ef
3737cf23085d017ce4acc0574d6841624973451fd6028597e7c045354f7e769b
9bf4fe113d9d646e58cd2facb609c9793e02517f0ea95a86940dcb0f6d916804
62d0faf01f74ec584efadfb6f7ab59514bf30d9684081298ffd88a2dc760486f
c16a9b6d2997107b08b137880a4c3dece11f41c0134332d1c978e6a9601a3b67
ca1506c0c90f44dea6541f166b1b839db97acc0a33600527a97df34fb433853e
715e315b101158ace555541c9f760c4dbc33f0142920ac816eecd09e15f31d9d
ebbb333bfdeb6b2dda784e0f70a043634251b2681ff4c6c5b41d0d8d83a30d94
b6c9fe5a8f92a10c26929a56599d16708541cf41e9615eca75702787cfd9108d
7ed14677a288271dc5c0e2812a74df12369116a1cd4ff3abad60e39d1a3204b0
4047e6b32f4dfe52915aa35b654cc753cc025abc4a70c083b8cac99b0a49fab9
eb7b77d13c06a3eed92968483c41c3a77c60b5c30db1ff0bb644e382e460198f
a826cb939a0df37bd8caa6c4c0795b97af2af5e064b419b41072c585e0fcbf23
68769184a1b357fa76ac2d0c52919f49f05be7520a5dece41e2052262e1aedac
45af9db782ba1daf6d98a345ff83b661d2cd2433ce23afe5a9c6711557cb4ce6
0794d2dc6d953bf92144011cca502d9d0ec407be9f3df15df37ab58b7829dabb
1ccabf5964ce97fed57ef4518d097cf9771e1b4db3a9fcd4090dee6db88778bf
09c98929d27c0fd2df66d9ac1e905bc5f73a8758827c58f5f079f7677f766ccc
3007b82659038d1262c1f3758c883f9cc1115a66a5d519c8cff47ab1f6f0c650
71f3e81a50c08a980cbdf45d224d240c5ba962cb9fa3cbc1a18339b69a4c1a82
c11776537e6e0284b3952cca72efe0edd51318f0162d4f35b28a00537299d072
0c1c39149b8b50eb7ef0cd9984a9fd30227da1e0622497374c5a0531652f33c3
72c636379bf7a2d0880564daae0a6f77d0f20e249dbcc418bd8c2c397617a939
a7e7a20744c618ea0c6c85864335c4b8851d126786a8ec85d8a6475e06284055
194cb8b725ad029ad4fb956faa7ca15da568563a1f34f794820aca0c1027f152
8e76e570a33f570b591e52ebf07ef17d0fa8882cc4462b1d8338eb21e345ef51
15aa7bde44b2af6f989bf8f39fb77e2d7220c10407117c4bf736c96d3cc242ba
667ea54c148754a8bbecf983fdc3b79deabd3123a341e2100bcfc88528e700c3
f2ba1fd143d885aa09758b8d83fc427ff50a459a86d2ad6ecc7f3eda02ed2fc3
9d16c3644d9c90fa28dfd5777663bc3a6f886403f2bbdbf64a4e453ee3d5e08c
2f236c136921e91f5c665e4b499002b80e1a987efbd4a0a5aa6522652d8c14cf
99e915cc6f7b25953b7f2c56b6c4c5bc0ff022eae67fb09ea46dd5938850bfdc
430093cd7411306769bc9663a1dfdcb0cdcf8662f9b81839371745e13e54697b
711aebc93869a3baf4c15d7c72aa4d81d5dfda4d20ed260f8c3b5a454b7a2a16
90683d108e56389d7474700c9bc1eae64fb3b835fa3d403ca7ed1b4f861c8c69
4bd7ec420a4f0ebe74a945370572a3895ca4e393ecd63c2384584b688ac7db31
5e8718b0eb902b73001ae7fa13cc97e089fb994ecfe616819f5433f49fc0b9bc
bfed45bf3ae36281d4d01c5ad1d4e1e65ca26937df0903b80af635d192fa7367
afc4b941592e41d89299e50030a8748b9c950f77cb9c4f08786b33aabc42a6b1
e0b2cafdd386e15867c61250e113b1775aa57a93ef32ff2c852f011fdb3aaf1f
f742febfd10cb7d19f21759f6d725c40ce90fb1a69013adedfc64b8dada81925
4ece6604d3d952b8265c769022e1558590944f95b7540a4b72f76181f37e4b18
fe594af07a31017b551c5ee2408990cbb3cbcc3eae0e7631640d68c70d338811
733bcdb4739e48f67c15289fba2a86f33c3ab61ee5d7c4916cad3baca8b9f614
6f1ca76d16cf50b6fcf6ce1cff5e3541a6594d8744ffa912bfe1528adc65ab1b
c3b8c6a1b517196f18482c3c9450161fd62e7a359972a8570f3f589f25f7fd87
e9908c41ae906ed08e50975082db94b7863bb72ebf56099b124a33733b1be34c
863c00f5624678f78b6668618ebcae6e2ca0aa7b5bd82b8ea8cb75f95c65d9a2
b9986e65a5c5d136d4873a6c31c2e235ec8c36cd0507539d542cdff4983c5165
b84aa72ce603000fcfce58ed24c57af50cbb38193b6632b45647042c7aa1438e
c8505155327592298ce6ffe5bf98c5fe2e5747e0911100caf7e8ce524da9a756
13b540ae1ede214cca02074c36d4c54b3a75560a2bc522cabde6d54bce25aea9
174337b044eca9a2a4ec85989bfb11e64260d9b46c74949e868bc0a1a7ccce6f
492fd9ace57f41d9c44e39fd5f5ee3a38d159bbecc49fb5f68a6960b65b47f2b
3bf9cb6bdd353d79f397855b168256eb9b70aaa4975afcab8a96b3899efbfedd
86cf7e2d8f16df730547a7e0320acbdd4714e71d083ac10045aaa68241c69a29
ea60a3d262926978be8f524a957e110614476c04e64dbe12247edce933ffd65c
b5e30ec0be5e4dae89f0a40937f4b173e97c61163f440e479ff0fc738d5816f4
23d035fa534c2506800ada801a55d7bb224943c5adae862158c710a974039331
48ba30a060a71f9bc7b11fbc734e2091f045cbce4a865c717d33179d867fb3f2
61058727489cc469472d46b28b2772b564f4846064d6cb57bc1dd130251057c0
3c8391009481b80893bbbad5be184c3499fe28dba309666cd90d87783e5bea04
0b915f8a5f4e50994a7034cfa82fa27ceaf14ae8304638f63c4d941c69638182
297d0623468ae151eb4d3bd07fd191911701537c91be82bb653d9e31cf676d2d
3905cf78405ad249adf367473ba1132d7fed797e908a6ba432204869a61a663e
c449b6d60457cc2e3fe1159f6b8cd13682bbb889e56dae46252f53ccf9f5e3e1
89ede846667958e0c98117216c764189edc9944b4f41fcade596a20063c4a89f
0fa1229d5d241f7827c4a01ffe22d93ace79ecff1b11ad8e386bb9722343f867
ce572c5394ecd0c6e00dc2536be9b40911b12446577fcf745b969a45c1f03b62
4ea69ac6578e3ef49b2f450f927dd3e13f4788bb5095c32f7d626eef16b753cf
cf547e19d5d496c3dcba6425d9768cb800c1cc3bf9768d24851387a7ca3ac3f3
425a1af68af7c0b9a3e414ea5ca2f8a618a84903938fb232b7b06d69a5da3db8
846d95c1797b69b1126e084ef0d8f6dca6a23b7ec5ad4ff78dab108647442bb2
08371e805c76119787c6d84ee44f45a347473c676cdb5c0ab9e0cc8382371a50
0db41845de6021a4b146ba7ad65e0e582e369e708f11d5a8481091511306a566
0e59e63bbe4f00bff4aeec444be3c8060288568d427a37e4fb3959c651d1137d
efbdd2ef0c7dc6295dd6fa46fa8645723896d9c3613899366d99356926f360a0
56e3be0ed6bdc22e5254ea7e7eb35c7ed4ce149be2ecfa34c24e81d32b52b5e7
486d00a24ce831d3eac68d3a5915e17436298dd3fb766280b9da624d4ac206a5
70f01489d075e73b0dc3b738f29df838092b0b95881d06c5428f3313d7a9eac2
9a6e82182f889449624ce89de3070143a387ac0797848b212c68fe284dc1374e
f5fccebac35756cf925775c6526084a0a8086ed7d7e9076f4c2572cfe6f93e9f
1d9e25dd369761d9d17df77839992b0a68e0562ac6d87d53868fd29f79df5d2e
651efacf638c6775e4388e460f3cc921a3f9460e43b635bc709f47bd50e3aa44
5bf5c1dc4ecd762931078d33ec12b9c335f0b8e941dbcc09d6914178c3506cd3
068851f56cc4b39c3582a29ca7739eaa9a9684e79da3082efae961e90ee3b167
28beb8c09ba72c04872625a105cb62cc5a75b9195d14e36c462dcf3c94b6625e
26d1a4c418e6d40b00650379f06e010cd2df24a4c35904615d6ff2af3c523b3f
81a5f68059f9bf2bf171619429376bd42d041632a106e62c02090cd094f714c1
06601632273040ad2ee841bf423a74db85365603c5d816e7ddb663481ec42898
cfff8468bc868a0134f0f5dfaaec0579f9c9d7443afa014e633d2a2f6b266608
ff59e068a01f2f4049bab9aa1b8d2f82a457fb8c02dfd02a03f23aa144db9460
730563f19bb8de9c3fdb3aa18482f0872610e78765a9d739c220d92bc3ebc3dd
6d0dad3c452f4775051fe34bc2e0c387657fec17ba8da2785ac5ee09cf6ee542
aa3eade5516080c9c9ba43f2c1b39652da007cb0300b7d618a3bd58b8e2460c7
1ab510c0f5b3d21010c9c733a65a68db4cb1c9ecf3a2e9e65e7a16d39b35b0cc
cc1da56ef77abcbf06fc830f12fd07e2ea96a6a213753f19bda0124fa1ae214f
272aa7ceaaacc1d91cd8ba8b5185ed931ee9ec9939b6c6c40d12b6c2ef3c6cc7
e2a4a0ff2c8d7579f71a83e9cabc38dc91f9c8936c8c78f64310390d7c8d2d68
10a27e4e927204d5132a941db2b911591e3fe4e301c0fa390e43c6b8f5243118
f4212e8881d01eaa6c057fa155d7df70f6a3a31537ecbe45507d0e6855ddb8fb
6f1798bcda4b1e5caf1939a6d5f63c8c684849781d0e4afe53123dfc25c73ddd
814fffb96a52a8ffcaef67bb87332785812c6599a7a8568f98313b6c1c0a5c8a
7847b3f2d359d1ffc7840b99b186ad86f09765bba9c9f8cd96762c7e706f9db3
679646680d29885aa3c3701be32b4b28e4539af294efeb2bc6ba03c5ee37b6fb
a99f9ae010294ccc7ee3ff1104247c820664a73dfbc5d21b0d970fcfb6ef833e
c19002e2671bd59307f3ca0b8d9530f31dcb2e7bada0e71cb0b2cc3cdf34f4f9
d24efa3772bb4dbc831de743ab83aa0dbc9288bee371ef9d12655d85750accf6
84d1f573c7fe6101d3aac115049a39af76fff74d0c1764aaef650dc5d4ba4f25
848d49656438d98d0f4dd1c6eb591bdd9066f7b21f2dcf91c6b9f1ef2d15c6cc
c246c03c89cd6de0dd9afdf9d9c821d18443fa556baddb5d92cf6e6206ad7bac
cf4c6819cb838028383cb1778c8d53eb956d5017d6396f81a0929f66f78fc997
c460adbbd3011ee07916bd8c14312b7445c26e2cac3f62ab16960d08a1fe74ee
306d75f3ee4916847addf6416b62ed9858ec7550e1995c748963732d62cb87b9
4d1f08722d9de557c4a7e4ed965ae562c9ac1939b9ba3b73033e58c529ffb9e1
8efc9d535f787d9505ade0d9048d3e317eb328d1223280265ea9483010306193
a384dd560652723b10f1df5176f8074e213299282b2fd26ed9add8246c02d8cc
7f59f9b62b6ae6115409c007d3c8910bd21a593978ce7b40358e049795484cd2
ebc34b2d2c03e3f543ba3908126c7597e1d23f39094459028b541b1f4ce034a0
0becf3cff36e3981d12d6a3991bb0303b4835a14bac199c18c73f715bfbea811
d82266802bb2a1760f8399f2447f790fbf3f2b88ffc54f10d980d9f46c836d4f
3ba71119e7da8a90083932b81d5564b79b09d454011000f7b9d437f55c2d5a60
4b37e7bc3ec2a06024a6e9c1fcdd9dcc1bbf2a31015a09f117c418e52b8a8fe7
001c9740d82d824844f9985955012752ab2b75c4d6ac7397062a5971364232df
34fa74244f7e85327784ea40ef0a8a28536d053e95c2642e83bfd961e1ef5e07
c8481d70b8b111a2f02ee9dd24c72db3398ff73d4d5842b62d959a4da968d270
0876c8cfa6fce7ba925879cf54cfc3e5e8dbd4ab75b8d272ec811181bca1d4df
d54f3bdadb94c4674cd01037f860825cdb26a1e4fe062a7bf5182b732f9e0994
29aeb28e68495be840534fd011575c0f88985e1d82b3884936356af63d0f4e82
999cd40c939e1b7bfc399b411333f4b1fd07ef1309bcc57bc5a6f4050a3a9bee
316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0
8533c12e9eb5af4589a1e0709e2ff953fc2c31c4d1f3e6a99ba30f646cda4995
8501f38b8e1c0c5a99a68e7133614652a1e85848cdd399bd733a370642160f26
9437b42764621fb7f37353132107d4bd82f86ccc3ad267ede3b569268e2e55df
21b2d45dc404f09feee230412dc45ddb12073b943bc24d1c9ff3ac5f19c210a2
731cef07b0144908619dc93ca3e4bd9567e7be9a02f32786da5620f71968ba26
422c2977acd9f122bd239132a53ff3bed17034aeec5dbe636f3a1aecb61d3bee
f3e03baed982186978c424eb7696f9df1989788364c02b2ab3456b518ab5eb94
0b231f67c5624428e7f6f568f47dea0cb9bea2d4af8974d23cbcc9d3601748e5
d37bc60df4e5be305a8e4188b8776c9d2c71e42a87a0766e4ec4e442aaa1fd75
85df34dd2d18f50b53d23692584502bc1241b2e998fb1266f579061b6941f82c
d7bff57cb0668411b55ead6b614d4360a9d5ca6bc396ddbe6098616b963f528f
1d61ce01a76c77bf21fd50558642cc009373538361de664b9ed12229e5a9ad72
b57b0b0833cee1ffd43ed55b852e70b41cddd020216a8d2630cf91dfab62941a
009216f8902e8c8bdc21572a2f33fcb40a72401d93124b7629dc5d2341bef653
ca0b6c73b0af017c63bb77f6623285daaee7e5a0ce18e3c3235ede15555a241d
997b4d20dbbae2a542a091e8ab0bc0f5bb3aec08c50ebfc3cff8deb412070d8e
d73942f809904f969e250ff6d7ce60739d751bf88f0e7114f44bc8acf4198422
a24696bc91814d3da6eae746775f924b93d040bfd8b2951d13bdbed35cc43226
7d4791bdc88fe1642e9aadae0a77c2642a3c366e2858ee7d2f28e8dad9f1eab1
81c1b636f19e9c19a8ff2b119ee2b240cb9d6921fafa10b98bacba957f1e9521
7548160d3253512383b83447d461d0df67340f3d2ca34646dd868c5c85e5c650
c8850912068a46bfb44c40b7037bd07037fb065cd5d266a95cafff9af55ef062
3a290e55182cb2a1051081e495a5aa4536d46b2c96c8e2d77021a562bdc0b7c1
badcc7d0cd88c2551db6062b283081590f7d72c77b794d4ff2487cc505a60ca8
adc935f22a1620e7b9b2086c1dc0cb0789e6d8c1babb4bbdaf94550a7feb7c72
436367eea8cdb72064ad9c0e5797dc57399695d17db500face828183086e5f76
cd8b4ff54ce46e742b0ce07d53bfdb18f5856296e56872a508f58c705345dca7
f1fe0a65c7e2ae1b70ee5c02dc24c27b9175018302541c00cc0f611aed40141b
26e01ec987904bc991b4621b6b2b546831212dbadcd51f7261c3822d468d0522
44b2591da49d1dd0cba85aa511a8018f90d76fbd458de5344f5fedcfdadef8e5
1030ebc868d8b1d17c2f08fae6ed61422bc09946b8e4840421366d942efa7be9
63a4b0dab558897b74810973ad467c8ee70873488d38c2cf49aa9877f22747c8
beeeaefe17f4c4b88e602d2a7360f76f4b36cc99bdf8a7075b001b7275eb93de
9dc1da6e3aedc1fc1e8d472cacf667341d3bc2ef1e13df1f0e1329415887ba1a
cdced77db448a467f8b933bc58c95c82f0766f0c4f5bbe8da222f61cd4118673
9d5d0fd63d75297c678af975fcbfa5314b34d9bcec0affd867c52255cbc24f01
22413d03ff00d237bebf7b269c7c6c83d1ffe79a341d9576e7f80fc2b42b066e
5539ad05c6385cd009e55639b038359361ee75b1960fc69c92e339ab21fc997e
e312cc6b47e46ab2e4ed6612d03b4da743744892ff3e4da1908022903cd2c757
a29570bb2fe1d094f7a69b9456291d724f7e01cb8a9f05d925b02934cd8a9f43
2c91155570a6ff17048613605a1e281037cc9f6c14e9b179c4bc929c67e63aff
cc3ff94cbcb7042619b80c9af32bd3d49ceea76e58737ac53ec21e318ad10d43
e7c48579765305ac140034dc1534d81541176d340d6763c59fa688722a032092
b937e2e8e208ed909f78918664cc13e988d18ee3ac9167059e437e3f80d5fa58
f51b69d826ba9d289116cba61629a4478e2cd2aa0a859b860b9a8f036a4877bc
b6eec03ed1264aeacc65db9429fdb0e83a250332b48df3e1037253e3763eaaec
e58185aa39bb04cda40a256ef44a9c2d976b51d9ded19aeb566aa5da418d095c
3f9a832c49bebb92e348443f52d4e3c3be4daf98c82eb0e0999ec90b49930d2a
32c3f57fd706aa2f5384cc3adda5007e7c28dbea002d0f5dcc0958f60cb1eedc
f2a9778a35d7d1f46de88611e8432bbb97fc16147201660273eb1333a59d7ddd
369fbc17d28849b2f9f33f5d761d348bd69ceb864e64970c9c7db0cdc1b421d0
f32c74c0bfbd26b155059d61b8fa3b83c78bd55cfd6d80bee529b948290ce1b5
9cff0b078c6aa9d0d067e678963025b1a5fc19a75acb2e08870702f8e35ec11c
f2aef8e9511e9f5ee49b76ab7d04703cb2fc478c0c66809d97136be681b0d7b1
436e47db6aeeca52cdf02f43812e8db6f46cefeb6707d797b4aaf32df9a1ec25
b65a199936bd6fc4f7555bfda10ef57fabe51958a466505037c3abc7c3adba07
dba2f671a33be28c6ec1096001df28c4be4ba70d413c7d293bdc511701a8997a
647cda5850d0f3f949b98494149f12e75bbcbb8fb3497dec4d5208b3ad3b6d16
92efae6877872a8c2ec5db5746d08ff0f21b086edfaf9d69bc8800fe398ee51b
5590d053a1709c79bb65677a2ea9cc401e3dc3ca7160e55a58ca9e69e6ae6980
4d0aed47b69dc43c6e4d705471d172f0f152a9c1c2906b0956781c97e0aaa65f
2bc2dfe39f0054c249a284392db3dae03ea44605c08104b4c95d8c6ca884e61e
6c5dd777658f1b6a4e0818d430f0ae1a100defc876ce3d61dd6a9bb682bd8b11
4e28195391e5033acb5ca35522a0205d5278e5cb0aeebd8bc78e8be9439c65b7
8417106bf26375cb725ffb01cc8a263280770ff3f4d922f4925d6f630ccb502b
dcfd356a600928a1421b8cecf48cdb1b9dab2adc29a92600cb6e1651ee83bcdf
109fcd6cc68ac92ff48508f6b88b2ce1e25d9fcd788140cce150a2d52f3f7b1b
103122dcb35d23245844a7078153ac77f1eb110ce024a4c61f841f8d11cd01d6
3b6586fe783767efcb3190f2965c718a636f85a152937dff883dec56b2bc9e5a
1537ee9bef61f14ff47dabd8993382bc36278b041968bf1072970b2a6421635c
46b6d8f1e0b6848ad45b80f785a93ff2b10313c877fef91cd0e97735d28e4514
69217e2b910a67bc3e7ed65c17c7680ea4481db0ae1df30dbe46dc610b9535ca
05bb813eb2649566be47fefc56da3ad7b01409edb0bf682bd41ce21e4e3635be
4383ffe24e922f1a8b8290dba9faf02d52b17bdccefaa8f69c19db76bb537626
89c1c23cde78ea40c3756301a8612949e23b86584ed5fa2f49ac2589b61bca15
a67e1a296014ab986232d32f1836f815576f04ede2781b6c42f89098fb1c0368
66f882759c84ecbe2d523b5c997d354010f3a757a648dffbd9a2afb0a4bf1bbe
4549151241d618ee565a7a3d36a9f0c7b413772f8c2c509b3b41b3b51912ed10
b87fa196d4c5cda207dd80f2548412730a99158e5c6019130d23cbb1e6d0cb2a
6de168d940cec462cc2cdead5a06a3b77a533558deb22bb4c0138ccb20f85f51
61c5d25b538f5866a842a91e04b405974441d364659e400aaddd37bcd5137166
460725b5a9a8f635e9e38fc0eb16560ef8d89a660d63530ce3059bd17d02d71c
df91d65bcb4ff7ad70cc2364d1e384d64bc1bf7da0c081e754f8c5fc6805ee54
47b21912ba623340a9c569d62c9349a94d342c40e63ecc2fed16999854aafe57
f69cee0856104a6f573df94d0c64ef873d1f56beb7d4df72084d21f68679e709
9b32eb26b980043f8f4c7c13b0956cf1e753d1935bd96056dccbc5a2727f51ea
85db2d7a82ef5c31f46c59f0bc497ff796183549d6bc177577a14037dab0d202
828470d0978f131cc02c4f07dee6499f8e5e44c21ee313987109942fa53721c3
76800b305528d2d0b68c468cbd8aee5a21b1c9c386dcd0595e8c07e059f4da50
5c1d56ecc2dacb122b653cfc058b60b1e1ed34192289d3d94745a6c8a6337aad
0fc302d9fc10620eb8077791aae82b7830e2ecadf6456284e4a7059144d5c282
cbcbcf230ab49902866ebb16670e89af1bafbc885916ae7d34ec0ad62e8865da
3bfa0107c919b679913bae710049ad72c96862a5e10a3e941ad4c21f5d397865
87110b5760efb27f9c86aef51ae91d7f8cc10557537b1b9ed407c6cecd118ed1
752c5346575c65d6b071b575cd4bc98ca840bab2426a1917eaea96894efc8c02
c63fdabb3d07f85ed2935d32d9d41fc58db9fd457a75f4404361172d64927c5c
0a6c17dc3eea59b75591030b0f8ce03b57a4e6ee017fba31bcfe85beffd523fa
57a5b9ad3db988d277dc20da8afa0d747b109e4f65f2bce4e02b3b8341f7aa85
6afecad578bafc4d97482c1217dc59d39dad36110b12fcdc197da5eb614793c1
00ac09e692560f5467ce94608a9199dbf5f1919bc5cb48c068cf2ff5f9393d02
43ccb79e6cf3521c6477c4ad90060a21865f5553b533ef58cbd1c68dbef0f189
12bed6b0683dfa5d627620ef48f94d65d60ebe3883129a193fa01160f2b9cb41
0ee55c68bed9bdf9e0ebe2fd81fe2b4d740c31589ab7d7b94f17c97917b97166
ad87e852a3c7c6e2e6f309c811aa24e184f87baedca159c81d5969070e9f0eb1
1b1ad9545962b79323343754bd959d6851fd23835739efe59c42293a75d96c3c
0201c8ff3fc3c6d8a149891d05db95d450d63e8fb22b8a991ac5a29e0f051b6d
800baed2a2422853e0fe86f22612151b984c82f1fb69e63d953647ae06c360a0
3283e60979e2767695506468f28d11aa16817e52182ce35d3aa99c0e02d3e8d3
ba57d356a1d70060f8bbaee2c4db56ef7ac1fa016da80b5ef370b9e4ed6a8f22
ae7d582d47040a7f4c5f54b2a6968e15ff6f32d09a68ec79d3c99201c8758260
5b850a5738478d8973e71f4ff93f40668ce24ebb8b83277f4df93adcabd8181b
4dcc15bdebbe7b5fcdfc81fdb3e09739ae6a79ac1e277631bdd807f447af8efc
2f65085666c2b43a9613c1a4e9e75bcaba63bcff97ea5f661761f9801dcc0c30
3bd157bfa96b1fa3ec83e8235fecdc4ab70c2378ab6a0694a0bb05e068294563
921d990dae1f50abb0681b75f02c9c4774f76176431a4822b682fffac7807665
dc7113c88a375406e74ba69be5f707aeb697612a10a207849774a03b025958fb
a821582e2c537914b2f0dc4098e2e602bd8f8c7c8e42924104db6d6399f10865
721686ac207b2bd85f425e2294585b9273a557b505474ff9bc7c567dfdc2453f
3cb051476c66ca5f3613450a836fae02609930a43fa694a8096f54a713e4fa26
b258407b7af95088da27c5f2894b25349069e673f44e78f923d6bfbf061e31df
5b84bbeb5f4470d18c8c99a06ca654922413a224332cd92defef825e879f334e
f3e50b2a5c92c86f9d58ea59671533ce4499d1219517e377e198202c80ea6199
98b22e05a733c85973dae71739d73f171c1c11e1c83db39d5d9f55c73754f2ee
e32ca9773094dc5f38dbfd0ae05cc2f134b3de614336a56b9d6f7ed372d4e452
07f2613b38c3968cbd1d349c75faa9dc64a838f401cc2e1c32d24197f733eb51
d7f72bcfcce979726e991052b99e9d302b9c34bdfcd6a1cd94bda16d6117879d
00325bb93c8e3cbafecf9f1810abb3a1f5976c3267dadd3fd094b20bf42eaf33
72f385b431a24a9f74897e53113bef7adb583626674bb9e3f7de2bf928634795
5f5487912a96d47dac78836bed3c287dd5da2992a6a5b31bdf50148cd0b4fb63
d4b84308c4614fbe6e266d604b107f04169f0b7c972369ef2e94dcf3afebdc01
02b824c85927347d5b8e3520767e9a4aa2e46ccd759048b55b5b0e84158022b8
6aa94e85759fc79e8f1c8ce8cddb0330b9f55898ec9c2bfb78589d75b6e51dd3
d2834fa972322f62bd9f84ab763de4f1a3f047e5d713255fef91ef17da392f8e
32fd42319d5c0adf926049a63e6241ad87e4a7fd8c551e0bd8cd0ed36292bed8
da713aee30cd30f99b804dad8efde056b254cf3fb6be65d7a983192e58c89556
SH256 hash:
9948ca32a6b49df28e370f4f8a2c7f9dae703a11a61990d6bd19e647b3469675
MD5 hash:
5ebdc3182a1cdaecb69f5b06157708ec
SHA1 hash:
5d9a70ba777b34553723cd07371cfe240a1e598f
Link:
https://www.unpac.me/results/b9a155b1-1165-454c-a56c-9007a4f80277/
SH256 hash:
316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0
MD5 hash:
08c28324179b6bb20cee61bd8ea4707a
SHA1 hash:
d5bb00bdcb445dff145517d9711f3b3ad46afab1
Link:
https://www.unpac.me/results/b9a155b1-1165-454c-a56c-9007a4f80277/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/316dc8cb3bc8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2654756/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/402007/

Comments