MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c
SHA3-384 hash: 6a3157df9409e229bacb6bf790fabdf061733579efcfec633de0e16b60152e041b942d55225b160fb312f08f6ae889e3
SHA1 hash: b788b6d7f37802333a4d9b3024c7aad517796356
MD5 hash: 8b756355ba79bab7795210437c784771
humanhash: kitten-nineteen-fanta-eleven
File name:8b756355ba79bab7795210437c784771.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:254'464 bytes
First seen:2021-08-20 15:06:17 UTC
Last seen:2021-08-20 16:12:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9351114812ade0773cab5940b106fe09 (3 x RedLineStealer, 3 x RaccoonStealer, 2 x Amadey)
ssdeep 6144:55Uk/MLjt8gXswsbMZV8bXXc5FPh/f7H4gFnL:rUk/sctm8b87Phn7LZL
Threatray 4'615 similar samples on MalwareBazaar
TLSH T17B44EF207A71C1B7C4634F3048A8C6D1E57AB9011B7546B73F4B26AF1E71391AA2AF3D
dhash icon 1072c093b0381906 (22 x RedLineStealer, 22 x RaccoonStealer, 20 x Stop)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8b756355ba79bab7795210437c784771.exe
Verdict:
Malicious activity
Analysis date:
2021-08-20 15:11:58 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/a0065cb6-1ea1-430f-8447-2b7130c52c5c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180990/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.9685.13292.27188.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Connection attempt
Sending an HTTP POST request
DNS request
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a file
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cf269aae-d031-4548-aeb0-4a8541c0d19b
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/836506
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-20 09:39:18 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwpuy7auu2hnlmfapeboupox66s5kftsxkqemcqs6lcsbghf3goa._file
Verdict:
malicious
Similar samples:
08719b0193b33919bd4042999fe9eb41236495659923c577b2164445b43732e0
RedLineStealer
09d58d081dd9364e99857ac273d52a17a0473cc64e64d0e15b2b9b2f67ef2d49
RedLineStealer
4023763ad7b1f3cae1395dcfbfb15317c006526c355914ecf7d8506696e3b1ce
RedLineStealer
6ad1cf3b42e1c571f6a7a402ad29e289ea119a6929345660a98e2786a3ddace4
RedLineStealer
786011dec9484fb81863be557b51a2adba291cee4cc6c6f91fd21c2ce94cb1a8
RedLineStealer
8498f560c45b7d2db3427aaf5a481a4e584a1aa8f59767147e895b60e08286cf
RedLineStealer
ebfe4a01a842ddcf434e44a288773454c4c5c35602a5fba3a31e47ff010a1314
RedLineStealer
f5cbd5b2ead7671d3b38fcdd59d46b1c5d66023630edf54c092f31ce988afa6a
RedLineStealer
+ 4'605 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210820-hqmzg8blpe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
193.38.55.35:16777
Unpacked files
SH256 hash:
20f51a8b7ba18cc060bb9411823d577c19e88e983147b8b019fb9840a747c4d5
MD5 hash:
bd51375220d31f518644f2987e0042ed
SHA1 hash:
ca214e38bccb9980215ef79312bb5b58424e19f7
Link:
https://www.unpac.me/results/f0d47767-edf0-4fb4-a910-d0ce53f0d26d/
SH256 hash:
a6ee0de5bb46d40154cc214ef9f8c411a5469568e84397921254ff354efe14c0
MD5 hash:
775fd6474f9d6262dd5aefd4d01e264d
SHA1 hash:
7fd7eb607ec54bc56401dcf730551b77107dd2b9
Link:
https://www.unpac.me/results/f0d47767-edf0-4fb4-a910-d0ce53f0d26d/
SH256 hash:
6a0ca824a72a8436be3fff2f37cc88240bd0c56594892ad473fa87b08b2f114a
MD5 hash:
9901bc810dad8840ac9aaa81cc26b332
SHA1 hash:
67683cf20bd4ab774c78978093ad5ff0506de8bd
Link:
https://www.unpac.me/results/f0d47767-edf0-4fb4-a910-d0ce53f0d26d/
SH256 hash:
359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c
MD5 hash:
8b756355ba79bab7795210437c784771
SHA1 hash:
b788b6d7f37802333a4d9b3024c7aad517796356
Link:
https://www.unpac.me/results/f0d47767-edf0-4fb4-a910-d0ce53f0d26d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1547612/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/180990/

Comments