MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 1 File information Comments

SHA256 hash:	3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954
SHA3-384 hash:	865c166a65ec0d5342d21047a9a956de059a02a4ba2aac15ad2df27ab6019a202f2e6848025a46cb735bf08436a6d693
SHA1 hash:	f7c6ee425a14cdc240617ae9e7ab7a749bfdc813
MD5 hash:	8d9e3abc3bd038d82076bc641b0aec49
humanhash:	august-enemy-grey-paris
File name:	8d9e3abc3bd038d82076bc641b0aec49.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	424'960 bytes
First seen:	2022-09-29 20:31:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d01827212726e3502549e8968b7084a8 (6 x Smoke Loader, 5 x GCleaner, 5 x Stop)
ssdeep	6144:svHD3dl7jG9rUmxIWazJhssBymgUWDyYG1n/uzbgwuO0QGqwVfgG:sfDNl7ja4zJJg7NG1/unnw+
Threatray	7'557 similar samples on MalwareBazaar
TLSH	T18494E130B6AAC877D57306714524DBA06F7BB8326DB085C72B14161D0EB2E9C9AF634F
TrID	39.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 29.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	38b078eccacccc53 (67 x Smoke Loader, 29 x Stop, 20 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
178.62.18.73:8721

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
178.62.18.73:8721	https://threatfox.abuse.ch/ioc/858539/

Intelligence

File Origin

# of uploads :

# of downloads :

242

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/314940/

Detection(s):

Win.Packed.Tofsee-9951336-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/40056/overview

Behaviour

MalwareBazaar

CPUID_Instruction

SystemUptime

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/633600c457a9522077cc3cae/reports/35893d22-bd16-4ffa-89e3-66dec6f34370/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/24bba59c-1675-4053-8407-2a75ba23a001

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1080494

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-09-29 16:29:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

36 of 41 (87.80%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hlwjxez7ds2eijypm4igdacizgjnwzpfharctlj37gbpuy5irfka._file

Verdict:

malicious

RedLineStealer

4234e2a3435803dd3a254fa3f2825bcc4f97dc0cc42fe6fac60064cc5960f4a4

RedLineStealer

5ad5e2c053553989b073a7b9fd56372e51376d8b82876a4992534461487f6a96

RedLineStealer

8687e077f773bced2e6d2a465208ac1cb3e1ed34726a31dd74bd89d4a233c9d1

RedLineStealer

a2de61e35702764a93d4f976b01facb0b636fe6a50586e5e032d8e3cd5899453

RedLineStealer

c0551d82c6d2d731ded09a070976d0a1311e370d815b43396c27ca8711eac6c6

RedLineStealer

cde6cabb94bace8b980b99066883facf73c0f1108d2e6c6ee7bec2e3ee93eeea

RedLineStealer

e451a7ae4629d9836050eff84f04056be6a178f0355e187a63f4efe96f15a56c

RedLineStealer

ea9be65022a6fdde9f5863572f182edc1b52d2bb07ea15099e64c4e3000732af

RedLineStealer

f19be850eb2b35914eb5c507ba3bff9c1c456d06e2a9a25feed03ce0333d1de8

RedLineStealer

+ 7'547 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220929-za94cachbj/

Behaviour

Suspicious use of AdjustPrivilegeToken

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0ee56892-8774-4788-af4c-a99458973a6a

Unpacked files

SH256 hash:

23f1aedbfb13b9a58eeb46dfcca88d18b021efd0096fa4f62e0742f36ae6d557

MD5 hash:

28a4659f329a5e5361edd189a01a44b7

SHA1 hash:

cadd826bb53bfcaee19a128ecc742bac798083c2

Detections:

redline

Link:

https://www.unpac.me/results/e54e7232-0093-4af6-9011-fcb1d27ec283/

Parent samples :

c96f914dd24ba81952c578e08d3d3e84bfe2c5ed63dc563ca0befcf672528ae6
b30432c3fa683e21501f1ad3a45edd4de2db3c5764aa1bec41a88759af426bfb
6985cf21dddfea3de38364fc0916058b3a051e8a8c2b513ba4457f8f127909ae
cec3c06a9c91cd4440eaea2e319ac92e9db7b175f0bd83edd341b0debcda11e3
3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954

SH256 hash:

a4913e62ca955ffbe8afca1141e9f80202cea5264e4d8c3f8146dfb14828fc4e

MD5 hash:

098f75aef13346c613aec32e52c35d32

SHA1 hash:

8078d26b480c1ead6637e8c6a444254fd85ec0e2

Link:

https://www.unpac.me/results/e54e7232-0093-4af6-9011-fcb1d27ec283/

SH256 hash:

29b526ba6ca29656846291411ca012c51412b2953fc3ffea6a7db5d77358905c

MD5 hash:

a604f602aa1ae12bbaa052c711a1c94b

SHA1 hash:

336e6dc869ab51c60574d508b95d010fb15e86e3

Detections:

redline

Link:

https://www.unpac.me/results/e54e7232-0093-4af6-9011-fcb1d27ec283/

Parent samples :

b30432c3fa683e21501f1ad3a45edd4de2db3c5764aa1bec41a88759af426bfb
cec3c06a9c91cd4440eaea2e319ac92e9db7b175f0bd83edd341b0debcda11e3
3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954

SH256 hash:

3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954

MD5 hash:

8d9e3abc3bd038d82076bc641b0aec49

SHA1 hash:

f7c6ee425a14cdc240617ae9e7ab7a749bfdc813

Link:

https://www.unpac.me/results/e54e7232-0093-4af6-9011-fcb1d27ec283/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3aec9b933f1c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3aec9b933f1cb444270f6710618048c992db65e5382229ad3bf982fa63a88954

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.