MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
SHA3-384 hash: e6e4c12fd8c54c39c1b25045958001adf3fba35875ff42a5c1d0665707d0023679f8bf6d56644524974c3c0904fb455a
SHA1 hash: e5b830af6a39f51b1978109d37f3f7241d0fbb16
MD5 hash: f59a83bde468dc208fbdf1b9ed28fa85
humanhash: batman-bravo-pluto-floor
File name:f59a83bde468dc208fbdf1b9ed28fa85.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:463'872 bytes
First seen:2022-11-02 07:05:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c06d8a269c77947b51e5a2f5172b35fe (3 x RedLineStealer, 1 x Stop)
ssdeep 6144:e8r6ml1NdMOr9GgBp6CB666eI+JMnAvier6VYpXUeIf7ITsq:e8Nl19Yg76GMn+Jl6DVYpXUR7
TLSH T162A4F0D134A1C032C093B5388521CB61367F6932D5A45A9B3BB4376E9F313D29B7A72B
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 0099993174e4c64a (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.24:47242

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
f59a83bde468dc208fbdf1b9ed28fa85.exe
Verdict:
Malicious activity
Analysis date:
2022-11-02 07:07:22 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/9317613f-143c-4660-ad5b-c776b77f9a3f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/327007/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.3680.13007.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connecting to a non-recommended domain
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/636216e0762855ef2d76ee5a/reports/dbf09709-3eef-4a52-96be-0404948ba248/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7b6c989f-115b-4dc8-a1dc-33a476c7cb1c
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1103007
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-02 05:58:14 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
27 of 40 (67.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlizlkp3mrgbmqfmop2fxthib2fgzhsu7otvdecaach5wzbfgawa._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:dozkey discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221102-hw3sqaaah6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
193.106.191.24:47242
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a52d9cf4-2492-4c52-8e94-6fdcf3791556
Unpacked files
SH256 hash:
e5d6957ed2d1dd8c8d2e94297ac49c67dce7b1969ca0e7ed719f352083232a7b
MD5 hash:
67f69dcc34c67ff5297c5e7bdcdf82cc
SHA1 hash:
79d986e6837eb62c1113bef9a7d95294fb5e1bd9
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/c49c91d7-1aac-4a88-a4ae-d6774e915ddd/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
294794b4e480bfaf0f96bff492d33c115a47d07c7b727618ca61f092d0f93096
MD5 hash:
2cb65c4dd615432dfcad784a2d3184c9
SHA1 hash:
5f7069d73db72c4786b5f88b7ebeb1b6adafd5a2
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/c49c91d7-1aac-4a88-a4ae-d6774e915ddd/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
ab53c1842d525b940656ef13277dcc83f1dc1d42cdc2f1172f786e9ae76421c5
ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
af669fa4f200fcc0c00d9aea49027d3d2ace15d6b055156195cf05ee6cd7906d
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
fd5e4d6282eb852549b996ab98aef3bc22c7f6e053a4fdc742b767daa801024b
MD5 hash:
8c982caea354e82103b3a9d4f4e60ae9
SHA1 hash:
4635f41b7a6fa18c4d09dc8416aa1a00c6dbdb10
Link:
https://www.unpac.me/results/c49c91d7-1aac-4a88-a4ae-d6774e915ddd/
SH256 hash:
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
MD5 hash:
f59a83bde468dc208fbdf1b9ed28fa85
SHA1 hash:
e5b830af6a39f51b1978109d37f3f7241d0fbb16
Link:
https://www.unpac.me/results/c49c91d7-1aac-4a88-a4ae-d6774e915ddd/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3ad195a9fb64/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2384053/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/327007/

Comments