MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs 1 YARA 5 File information Comments

SHA256 hash:	31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97
SHA3-384 hash:	50e70e99000e472483660215c0309119921dbb5241cca3c9a23b4487f2f7747d0f7fe1cf76ecd06c29f65353ceb4df74
SHA1 hash:	76d36117d58b5c801c2d698eddc414b0a06bed05
MD5 hash:	8ae5c67ba12d7028d34831679c57f372
humanhash:	uncle-spring-four-violet
File name:	8ae5c67ba12d7028d34831679c57f372.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	681'984 bytes
First seen:	2025-01-11 18:10:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:GTBtWYMV+I4MVKW84KMmxGSeR6NKPpdCVsYJabrUKcQO++Zzo+JdNS2tJHB:wLGRgl4KMnSGzYJpKch++Ro+k2tJHB
Threatray	219 similar samples on MalwareBazaar
TLSH	T179E469054396D4C1D0C705BC28A3FBB791584F484A25CAC267EDB9A73AA3A8D750FDCB
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	863b292b234d2b96 (7 x RedLineStealer, 3 x AsyncRAT, 1 x Formbook)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
185.222.57.77:55615

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.222.57.77:55615	https://threatfox.abuse.ch/ioc/1381872/

Intelligence

File Origin

# of uploads :

# of downloads :

581

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

8ae5c67ba12d7028d34831679c57f372.exe

Verdict:

Malicious activity

Analysis date:

2025-01-11 18:12:33 UTC

Tags:

stealer redline evasion lefthook

Link:

https://app.any.run/tasks/0bc33555-6ed2-4cc2-a98a-1a4ca1fb43c2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Jalapeno-10038995-0

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6782b4371e9cdec7dbbbb770

Tags:

infosteal redline

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Connection attempt

Sending an HTTP POST request

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a13d76de-86df-4fb7-88d4-be5c73edbdac

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

0 / 100

Link:

https://www.joesandbox.com/analysis/1589215

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97/

Threat name:

ByteCode-MSIL.Infostealer.LokiBot

Status:

Malicious

First seen:

2025-01-07 13:12:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ggroymoeoiwtaenxkwk4o3thpk5h4w6bmtdgpvyjsq4jh27kj6lq._file

Verdict:

malicious

Label(s):

unknown_loader_037

redlinestealer

RedLineStealer

6eaf9b6af911a7995d490906ff5d42a36a47e4b1d4510f6fc33c7cdab2c80aae

RedLineStealer

9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f

RedLineStealer

error

RedLineStealer

f53d0f2f29ef10e16cd2d607a545c3523dfc9f4e0b04e0b4258740357c525253

RedLineStealer

+ 209 additional samples on MalwareBazaar

Result

Malware family:

sectoprat

Score:

10/10

Tags:

family:redline family:sectoprat botnet:cheat discovery execution infostealer rat spyware stealer trojan

Link:

https://tria.ge/reports/250111-wsk1dsvqcw/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

RedLine

RedLine payload

Redline family

SectopRAT

SectopRAT payload

Sectoprat family

Malware Config

C2 Extraction:

185.222.57.77:55615

Verdict:

Malicious

Tags:

redline Win.Packed.Jalapeno-10038995-0

YARA:

n/a

Link:

https://app.threat.zone/submission/4d10a125-0d89-40a3-8c1c-5385ad8fe2e0

Unpacked files

SH256 hash:

a0f9e9eea076589b1304306fa13a8b847fc29c7b9c65b30b04c0b06018769344

MD5 hash:

9486c4257c054ddceaf0385d6a9a1f42

SHA1 hash:

c05c94d9ecaf47d289f6624ef1701fb48f5aa73e

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/6684edb6-8b7a-4741-87bc-4792fcd719bb/

SH256 hash:

168b6065d141a70c80f8c09204fd7252eb104de2e450599fc5896c1439322f6e

MD5 hash:

96858749c6f54f23560dc6a5aef2c32b

SHA1 hash:

861a04be243f05efe28e6d5dd5409ed56ff64476

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/6684edb6-8b7a-4741-87bc-4792fcd719bb/

Parent samples :

6889d04a51c7a76b2ab1b4161b2b5e5d17dc2780e29dcc78b41460f982986786
ea2305b81698e84ea423f196cbea17b3eddc98c57d5f53342f5ba82fb5ea3856
8515cd8f15f1b16373993dfb77427a0fe071abb0384f9bfe55f14adc4ff5d30a
cbae135ce99b7218f36189a750bca0868612e0c2ba0ab5fed90a32bc123d989d
87c6bd3556e570f5c0acb04c5286da5b222d6f4e2105827ccde74e4123ee55aa
67cc97b2f5e9d35039589c92c7f6fda7831af0f259ddf248fb166664e4027b91
24777f80f39fba9da6a66bb0804bd3c3a510126f583eefb8918e24fa5fdeb69b
c024729558cdf11515cc4024d0f3118d8313a86c68d48846376c55b8ec97c0e4
3652dcdb4eaff1a11ff293eedb80363e024bda7a33f1e1c17b082dfd4cea5a86
4ae69707fe39339915373a1ec3adaea49a73a9656c99fe27ecda591049be9d53
9604ee9c0cf521a022d9726b2e1dd82e6b3813d2ade567430b39a2fd9545063b
1787fd4fd81dca24ca10625e93d43168eea906184da17183ba53a306856c0f28
31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97
31dd67c25cb99830d6df7e63abee058598eed026076acd4a659fed12fd8647ef
4697e774285a7b1624b2240cff212aa16a59a91bc1d397e55b5e4b1f1d54e95f

SH256 hash:

07fd75faf1636eb7ee5275c7ef4ab3a127c3a3af93aa33ee9038191737f3326b

MD5 hash:

4b08e6130f3f8093c95ffe5fb239a750

SHA1 hash:

4b36ce5482beddab8d35ef3cbba8cf75240270be

Detections:

RedLine_a

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/6684edb6-8b7a-4741-87bc-4792fcd719bb/

SH256 hash:

31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97

MD5 hash:

8ae5c67ba12d7028d34831679c57f372

SHA1 hash:

76d36117d58b5c801c2d698eddc414b0a06bed05

Link:

https://www.unpac.me/results/6684edb6-8b7a-4741-87bc-4792fcd719bb/

Malware family:

RedLine.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/31a2ec31c472/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample