MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33dbcd449054ac6c2580e7d8384f40425f685f554402fe4c30ca2ed83938fdc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 1 File information Comments

SHA256 hash:	33dbcd449054ac6c2580e7d8384f40425f685f554402fe4c30ca2ed83938fdc6
SHA3-384 hash:	6db723c06d6f994230e4c4ddf0720c64c6411dc607a02470d716c02d7f4c0980c5035c54055973b4c9bed24a9f56b6c1
SHA1 hash:	89cebdac8c188733c4aa002c4186d43b4bf01f4f
MD5 hash:	bfb96f49e08ba58a36a01a8d9f290894
humanhash:	ink-violet-sixteen-early
File name:	bfb96f49e08ba58a36a01a8d9f290894.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	419'861 bytes
First seen:	2021-12-18 14:16:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	97510e08b27860260a6b4085182271af (6 x RedLineStealer, 1 x DCRat)
ssdeep	6144:G/H4UvwYogRhavtZSh7URusIGG+xdWnPbc4dtHMWJn:mYDQwVMh4IGG+xdWDc4dtHFl
TLSH	T13794DF00ABE0C034F5B752F449B6D3ADB63E79A21B7494CF62D456EA4634AE0EC32357
File icon (PE):
dhash icon	a024e0d2a4c8c999 (5 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
45.9.20.240:46257

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
45.9.20.240:46257	https://threatfox.abuse.ch/ioc/277335/

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

Win.Malware.Sabsik-9916379-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2491/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/61bded6b8991ba72b38b4c20/reports/a2df4d4f-21ba-416b-828e-16b9a4beb292/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/004e2231-7f03-4fb8-88af-9a8a50b5f883

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/909539

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/33dbcd449054ac6c2580e7d8384f40425f685f554402fe4c30ca2ed83938fdc6/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-12-18 19:39:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gpn42reqkswgyjma47mdqt2aijpwqx2viqbp4tbqzixnqojy7xda._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:170 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211218-rlpyjsfbg2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.240:46257

Unpacked files

SH256 hash:

eeca0dad743736c8a15151b3185e1a4fcd368fde8336d33e9c4b2371fe7efbde

MD5 hash:

9aeb7624a3e9dfe978992a04d786535b

SHA1 hash:

7ada1dc5fc79cfaed7de873e4fd913747fe53184

Link:

https://www.unpac.me/results/e17afc08-43f2-46ff-8141-21c0f5fd3352/

SH256 hash:

a2d69ba58df889dc3a00c1659c43d271dcbdd46c8b407eef0e180d8a8a5b2a1f

MD5 hash:

3044f57a995d64048de68d4b16d17011

SHA1 hash:

365c6b6e165e8e25918ac26b813f6091b1e70175

Link:

https://www.unpac.me/results/e17afc08-43f2-46ff-8141-21c0f5fd3352/

SH256 hash:

bead33b1c8ba6580506505fe7c4e0c01ab9d63fba5cbcee44c6409c08c2c5a59

MD5 hash:

3554fad347ec20642834c2f134c3c11b

SHA1 hash:

13ca25f2935c4dc59ccbfb1dc8141f92deee8194

Link:

https://www.unpac.me/results/e17afc08-43f2-46ff-8141-21c0f5fd3352/

SH256 hash:

33dbcd449054ac6c2580e7d8384f40425f685f554402fe4c30ca2ed83938fdc6

MD5 hash:

bfb96f49e08ba58a36a01a8d9f290894

SHA1 hash:

89cebdac8c188733c4aa002c4186d43b4bf01f4f

Link:

https://www.unpac.me/results/e17afc08-43f2-46ff-8141-21c0f5fd3352/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/33dbcd449054/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/33dbcd449054ac6c2580e7d8384f40425f685f554402fe4c30ca2ed83938fdc6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.