MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32420d512aecb2598e0e2c7237e796562e54984a4b21d45210a1d7a3a6763831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 6 File information Comments

SHA256 hash:	32420d512aecb2598e0e2c7237e796562e54984a4b21d45210a1d7a3a6763831
SHA3-384 hash:	1c3694a7ea9a9b51e2e6b018a736d16835cb0ad806c4ce19be4002380bffcb641f6430e74ce95d124e1e03e71cbcfcdc
SHA1 hash:	9cb811c2b7de5de13f14b2fb8e3c5f0e9588a708
MD5 hash:	b29f49c10aa6ee998d8a70c1471eff26
humanhash:	alabama-solar-fillet-burger
File name:	b29f49c10aa6ee998d8a70c1471eff26.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	301'832 bytes
First seen:	2023-03-31 10:40:12 UTC
Last seen:	2023-03-31 11:35:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	853e226a0e0caf1288b221f1c013407b (4 x RedLineStealer)
ssdeep	6144:JT23mFW8bcuj8n1oAXJLYwb95etgCFlsYthl:s2FWgyF5Lz9YTjsYh
Threatray	3'721 similar samples on MalwareBazaar
TLSH	T19A544C73F1ACC105D278AEB8B0F48735912630A07A9140A96A777F25045EEC69B7CFA7
TrID	39.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.5% (.SCR) Windows screen saver (13097/50/3) 13.3% (.EXE) Win64 Executable (generic) (10523/12/4) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
135.181.173.163:4325

Intelligence

File Origin

# of uploads :

# of downloads :

253

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

b29f49c10aa6ee998d8a70c1471eff26.exe

Verdict:

Malicious activity

Analysis date:

2023-03-31 10:40:31 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/0b1335dc-81e4-45af-a14b-2bac2d395b52

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/379046/

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.14002.883.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/75886/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

86%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/6426b8bf83048b7317ad08df/reports/028840bb-5739-4afc-9797-07ceb8c63799/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/32420d512aecb2598e0e2c7237e796562e54984a4b21d45210a1d7a3a6763831

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a4443667-11c4-4619-b2c4-d08a9129bab2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1205836

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/32420d512aecb2598e0e2c7237e796562e54984a4b21d45210a1d7a3a6763831/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-03-31 10:41:08 UTC

File Type:

PE (Exe)

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gjba2ujk5szftdqofrzdpz4wkyxfjgckjmq5iuqquhl2hjtwhayq._file

Verdict:

malicious

RedLineStealer

097bd6ce6d754f614b0cb7c0be5f4adeea5fd65bfb736208619c1b3d4cbbfb7a

RedLineStealer

34db61f23c2701386292bb8c50ee4a0a425051a255335b07c17a880aa185666a

RedLineStealer

5331428611e6a398284611837de8d995d012abbc444f69acfdfb370ef6655f88

RedLineStealer

711e3aaa29ad4bb5581bff65bf3e8d67c4afe4a855dbbe19526cbb1e7f6e0992

RedLineStealer

8680792867002950ac3e93c175ee2394c0bc8ed3c0e4bf0b2d84ad4a998e77e7

RedLineStealer

8ae79bd64f0f7222b4b2130855e80228efa732505718bf2f436927c6315ce8f4

RedLineStealer

cc9faa4d1d9909f267a14006282af5bf3a16bc25fd056c34a8481bfdf1586907

RedLineStealer

dfe8b10d567d99e44deed014c4f686a1d28fecf9d763ecaefd24916551a75707

RedLineStealer

e974acd3fc49aec16b85d46b91375e04f2f69a5332fe3fbc0182fbcb1c61a425

RedLineStealer

+ 3'711 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer spyware

Link:

https://tria.ge/reports/230331-mq4kaahc93/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

Malware Config

C2 Extraction:

135.181.173.163:4325

Unpacked files

SH256 hash:

03dd159c8665e107669e4f89f99a23642769f6e1360b7664770a59056ed160c4

MD5 hash:

2268be2f9774048ca9a2753dd2d284ac

SHA1 hash:

eacc040bc8ad92019c9b2dc2712eb629b9ad727a

Detections:

redline

Link:

https://www.unpac.me/results/b020b105-6981-4ab8-b7a4-c70c0578d42d/

SH256 hash:

32420d512aecb2598e0e2c7237e796562e54984a4b21d45210a1d7a3a6763831

MD5 hash:

b29f49c10aa6ee998d8a70c1471eff26

SHA1 hash:

9cb811c2b7de5de13f14b2fb8e3c5f0e9588a708

Link:

https://www.unpac.me/results/b020b105-6981-4ab8-b7a4-c70c0578d42d/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/32420d512aec/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Win32_Trojan_RedLineStealer Create hunting rule
Author:	Netskope Threat Labs
Description:	Identifies RedLine Stealer samples
Reference:	deb95cae4ba26dfba536402318154405