MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
SHA3-384 hash: ba98874411c811cd5b09ed254214479ab5d81ec1ead68d93d1b6756659f4045774dbfa80ff5728ae80221004b6ec1866
SHA1 hash: d06a20d494d01229d0108df407c2ea40ae5af442
MD5 hash: 87768cd45992b45729a2da1f578ebe74
humanhash: hotel-pizza-crazy-snake
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:418'304 bytes
First seen:2023-02-02 14:30:48 UTC
Last seen:2023-02-02 15:29:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e479a558a3a55c2bde918dd7ce07e020 (8 x RedLineStealer, 1 x Smoke Loader, 1 x Rhadamanthys)
ssdeep 12288:MtiMkgP2LzDIv9min01tImh9CJb7d5i4:3gPYzEvEO01Wmh9qb7d5i4
Threatray 15'290 similar samples on MalwareBazaar
TLSH T11D94B042B2A0BC49DD318B72CF3EF7E4791FF9118E59B7BA1218AB1F14711A1CA52325
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 088c44048484c480 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.110.203.101/puta/brazilx86.exe

Intelligence

File Origin
# of uploads :
26
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-02-02 14:31:08 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/dd6c4562-a0a6-49fc-a64b-9691959f463f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/359575/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/63dbc92789bd67c10fdc36b4/reports/36348681-aaeb-48ca-b4d2-9dd149e449b1/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8d8ae5dc-ada2-4bf6-948f-458488e9f5cd
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1164319
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141/
Threat name:
Win32.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2023-02-02 14:31:07 UTC
File Type:
PE (Exe)
Extracted files:
86
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=he4p4zk7wldo5uxpkjteeua2wfdw66bawjpkgexdebbcjiumafaq._file
Verdict:
malicious
Similar samples:
2b49784b561617cf947f55faf2692dcd97960f92e50dc9a1eeb926d534d56e77
RedLineStealer
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
RedLineStealer
6acee31b7d70a5d29bd227366ca6ff41aa3f40086fcb6cdac93181bbb4052bf8
RedLineStealer
755cee37572cd6adec4750735f2a6fd9cdb15dcf3c988d49771a1f5772b51705
RedLineStealer
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
RedLineStealer
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
RedLineStealer
de1c0019ba6049f083253597fa8b05028fd13c99c604896ab52a80d8fc436a1b
RedLineStealer
f631e0f585f43a7ea2cb466f7fda23b13fc0551206207c027eeffbbbf153db3e
RedLineStealer
+ 15'280 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:2-2-2023@ discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230202-rvpzxahc6x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
91.215.85.155:32796
Unpacked files
SH256 hash:
02d15cc70446bda384a483ed4d81e5fd4bf7a2c5848ea5ec355fa693dfff8503
MD5 hash:
b95cc5ff84e75ce7bbc38edf9f0746fa
SHA1 hash:
a3c4b7ea0200305a45cd6214ec63ec6948dfb6b8
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/187884c4-1f23-4aa9-adb6-c49ba0c96436/
Parent samples :
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
5243496a6317fa28696043916abcda8a598d9e4b3d101a04d8eb33c8f998d227
MD5 hash:
fa49d962de59c209b6f269007a1dfb49
SHA1 hash:
322a177a0031221ebec3dc788166e4946363f830
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/187884c4-1f23-4aa9-adb6-c49ba0c96436/
Parent samples :
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
a09bb30e4ac852eeb4fbfe3c4900606f83775936b6be3c175c4dc773376a273b
MD5 hash:
135d8693f5bddda089165c5d0461cf8e
SHA1 hash:
0b93c573787c2bbd9f6dc0a5aecacd95d271d3de
Link:
https://www.unpac.me/results/187884c4-1f23-4aa9-adb6-c49ba0c96436/
SH256 hash:
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
MD5 hash:
87768cd45992b45729a2da1f578ebe74
SHA1 hash:
d06a20d494d01229d0108df407c2ea40ae5af442
Link:
https://www.unpac.me/results/187884c4-1f23-4aa9-adb6-c49ba0c96436/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3938fe655fb2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2498781/
Cape
Cape
https://www.capesandbox.com/analysis/359575/
  
URLhaus
https://urlhaus.abuse.ch/url/2403396/
  
URLhaus
https://urlhaus.abuse.ch/url/2440457/
  
URLhaus
https://urlhaus.abuse.ch/url/2526742/

Comments