MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0
SHA3-384 hash: f4dca3a1c13b27ffccf4205688c2ae2261a1ad14dcc546557bc128dad9962a44aaaf90c9a0d6ee17bb97f359bc1c2cb4
SHA1 hash: f060b6b2537b6f8d555eb48862f30f67d000968a
MD5 hash: 5f0cd9ac657a0eb96e77805bb60bbf65
humanhash: high-whiskey-zebra-lithium
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:293'960 bytes
First seen:2023-11-25 22:54:55 UTC
Last seen:2023-12-01 12:03:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 523157735e566b276bee878a6353a15f (1 x RedLineStealer)
ssdeep 6144:3ts2X6GO3SSjYlMRSPhjw6Gl/ncS3nSjPF9GW8nQ:3Z6pAwHnTnS6WZ
Threatray 1'636 similar samples on MalwareBazaar
TLSH T1625406C923B294F2CA2BD0FE5B6A8643237BA8755561D5AA274235F1090D05C3FF7B2C
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc418490229_668825385?hash=fmxZZpfxyKzoUkZxcVHW3noWiv5jntPI9QSYHRcI0RL&dl=xeVgrz2TSNdBcb0Zdhzkt09jH4166lsF7ErdfOX591P&api=1&no_preview=1#3

Intelligence

File Origin
# of uploads :
61
# of downloads :
313
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/460203/
Detection(s):
PUA.Win.Packer.Ep-7
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware icedid pandora ransomware
Link:
https://www.filescan.io/uploads/65627b47380413dc0c200bdb/reports/8af56778-8263-4632-b778-a886ec687abc/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a3d3d26e-eadf-4f8b-8a66-1ca1ddfc1aa7
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1347798
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-11-25 22:55:05 UTC
File Type:
PE (Exe)
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=holrj3brappolwob7fc5uvncplolumgyzxv5nae3s5u5rondbtia._file
Verdict:
malicious
Similar samples:
26bb80ea94240a03b487cb1f62459d06a8ba4f9abc207cb5372a49609bfbabcf
RedLineStealer
3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0
RedLineStealer
64263a4ed1a6432b06bc1729d818182081babbe97f02fd6f61f2d09e3e657dc0
RedLineStealer
a0f6588980293c6a7433beef8226b491b3bd6246dc4930d08b45c0eb7b31d84e
RedLineStealer
e51d0b81ca8d23771538b6f9f787293c86fb78ad2d30fb09a57a9f8bc301dac7
RedLineStealer
+ 1'626 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:yt&team cloud discovery infostealer spyware stealer
Link:
https://tria.ge/reports/231125-2v4headd57/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
194.169.175.235:42691
Unpacked files
SH256 hash:
5257725c5b8170ca39690a9c6d7b9e58e3ec9daa0968de17c95ff6de3a1f76a4
MD5 hash:
ebf7012f725e0d883a77c0ab959dd419
SHA1 hash:
3c6bba16f5b5eb6077c13402f2854bd41b49f453
Detections:
redline
Create hunting rule
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/7bded014-e642-4295-bd8c-e4c00f6d36ef/
Parent samples :
697dd2c3533e5fd0096fa003da7141cf54575fba97208e52a73cb6d3385d6656
a23ab45827494e672a57c422d842e1a0c53393b2f28335dff19b76d61b2dac29
0f6464732f9c7428188f1f53dcee84f1eeb7821df69abfa866ea7ba7f06e0d56
7d969fd0a02104e41e9e377433bde1344c5d919b352184d7de814fe787c95702
8dfae05eff92ce87acd6c78f6d1ae08f9ae5d1537ac6cbd4ba11c5ed457256da
3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0
SH256 hash:
3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0
MD5 hash:
5f0cd9ac657a0eb96e77805bb60bbf65
SHA1 hash:
f060b6b2537b6f8d555eb48862f30f67d000968a
Link:
https://www.unpac.me/results/7bded014-e642-4295-bd8c-e4c00f6d36ef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b9714ec3103dee5d9c1f945da55a27adcba30d8cdebd6809b9769d8b9a30cd0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/460203/

Comments