MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a46933c7d6d74d19ab811a5ec5c675ff1458d63c455005e327a60ba25ae442d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a46933c7d6d74d19ab811a5ec5c675ff1458d63c455005e327a60ba25ae442d
SHA3-384 hash: 033e2b43c2c2121f4554459a1100627ed0d8ef4cbcb44f6640caa78aab1cc35e64652ca098c15ec5712293591932953c
SHA1 hash: df4eea60c4adb6ce8127230a50978a853a011975
MD5 hash: 1648114b333d2d91b58d9c450550d4b0
humanhash: iowa-california-muppet-kentucky
File name:3a46933c7d6d74d19ab811a5ec5c675ff1458d63c4550.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:363'520 bytes
First seen:2022-05-16 13:01:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4556af061fe2abccc21c2f8048d4d531 (2 x RedLineStealer)
ssdeep 6144:4WmPj9bIFX6P/RJEWZbjNHk7fbUMNs0NozTHDO2:5mPj9bweJJEWIUusMY7DO2
TLSH T1287401227390C432E4923A708D35DB619EBAB9320671784F27A0337E1F717D29BB5766
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 5c595a3ce0c1c850 (5 x Stop, 5 x RedLineStealer, 3 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
178.20.47.241:23253

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
178.20.47.241:23253 https://threatfox.abuse.ch/ioc/571412/

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
3a46933c7d6d74d19ab811a5ec5c675ff1458d63c4550.exe
Verdict:
Malicious activity
Analysis date:
2022-05-16 23:23:13 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/d5004318-88b7-4e8c-8df3-97534421d1d6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/271139/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Stealing user critical data
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/18028/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/62824b50fd71ca8b2ee54ec5/reports/32d6177f-a886-40be-bced-b45c27559540/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1e196ca9-4df0-46d0-bbb8-24720ffba2e4
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/995099
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a46933c7d6d74d19ab811a5ec5c675ff1458d63c455005e327a60ba25ae442d/
Threat name:
Win32.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2022-05-16 13:02:06 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
36 of 41 (87.80%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjdjgpd5nv2ndgvycgs6yxdhl7yuldldyrkqaxrspjqlujnoiqwq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220516-p9r2psced9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
178.20.47.241:23253
Unpacked files
SH256 hash:
4da9d20592f15ad6e34c6335cedfd3bb357731b1112e93b5eafd943fcebc0e52
MD5 hash:
338cd37702ac6ebe956842dee4efe602
SHA1 hash:
eabf0cdae34017b04e015a1340daefca4ac5ea4a
Link:
https://www.unpac.me/results/006f3103-21c1-4c54-977a-126c1f3db488/
SH256 hash:
75fb713c344b9e10ad5ecdd3fa4385d188f2a35cf23b98309ef796c7a51fef7a
MD5 hash:
fd5c263c078ca7f9b5069196b261a673
SHA1 hash:
9af9f34d56f503910b0a6703f992108ad23f78eb
Link:
https://www.unpac.me/results/006f3103-21c1-4c54-977a-126c1f3db488/
SH256 hash:
2120596f354e467b795d42c123a6d481802c505db820dd0b0ba34908fc846d5b
MD5 hash:
275f835e210ef1a29fee2f0853dfbbb7
SHA1 hash:
4cba85fd08045cfb4249cb5c66c07201b291ac18
Link:
https://www.unpac.me/results/006f3103-21c1-4c54-977a-126c1f3db488/
SH256 hash:
3a46933c7d6d74d19ab811a5ec5c675ff1458d63c455005e327a60ba25ae442d
MD5 hash:
1648114b333d2d91b58d9c450550d4b0
SHA1 hash:
df4eea60c4adb6ce8127230a50978a853a011975
Link:
https://www.unpac.me/results/006f3103-21c1-4c54-977a-126c1f3db488/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a46933c7d6d74d19ab811a5ec5c675ff1458d63c455005e327a60ba25ae442d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/271139/

Comments