MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66
SHA3-384 hash: 7045c67b1208f506d8aa7165c0cb4c9806a23810c68ead45f2e5f55c73eed6a1e8e984ce00ec7b8dd4fcb154f98b9f2b
SHA1 hash: 3a66126554e7d7e0661ca0c8358941a6709170e2
MD5 hash: 73149ae2e584b3d3829ea6cd5709035b
humanhash: india-steak-video-harry
File name:73149ae2e584b3d3829ea6cd5709035b.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:354'304 bytes
First seen:2021-09-25 09:48:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6abb333342201a93de1795b4b0940b40 (12 x RedLineStealer, 3 x Stop, 2 x RaccoonStealer)
ssdeep 6144:2xeqeqy2yK5YLbeFgC9C9OZLW8+46ufhwswHonzmixsIrIjQBzUIH:ZOy2yK5YLIv9jZLLtRes2onzmW2g1
Threatray 2'274 similar samples on MalwareBazaar
TLSH T1A574AE20A6A0C035E5B726F449BA93A8A93D7E716F3060CB22D527FED6346E4DC31357
File icon (PE):PE icon
dhash icon 9824e7d0e4e7215c (2 x RedLineStealer, 1 x CryptBot, 1 x CoinMiner)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.9.20.20:13441

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.9.20.20:13441 https://threatfox.abuse.ch/ioc/226443/

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
73149ae2e584b3d3829ea6cd5709035b.exe
Verdict:
Malicious activity
Analysis date:
2021-09-25 09:53:26 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/b7d0ca8a-a31d-431f-a190-008c4be49e5b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/191489/
Detection(s):
Win.Malware.Fragtor-9895683-0
Create hunting rule

Win.Malware.Fragtor-9895686-0
Create hunting rule

Win.Packed.Fragtor-9895692-0
Create hunting rule

Win.Packed.Fragtor-9895768-0
Create hunting rule

Win.Packed.Fragtor-9896146-0
Create hunting rule

Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/385faed7-78f4-40e8-971e-49c6766f89b6
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857948
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-09-22 04:14:54 UTC
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3cieyapt65va34kq4dn3agth3yw6doxskohxx7cwj2v3wyftjta._file
Verdict:
malicious
Similar samples:
0d27e1904d942e4d52fbfbd2b8ab2753bfbad6f2f38de183bd2afe6d397b2807
RedLineStealer
176acbd438f1dbf033098a230dc2b5066b38d53a2018a4da03c6cc2bfb8ade99
RedLineStealer
41a07231a545437d57e20e3863390f8c529a27d75515c903937f2b488e124e75
RedLineStealer
7528f5fc6feac45e0e9d7e8e2f2e050f73da78d65937db34595904a284ca2f93
RedLineStealer
7872580d5105bd09cf386f9713b28854711d356fae34118bd855a9a694da4f1e
RedLineStealer
9ba1db35f1faf6730c60c798a290ad44ca12170b002b4e721428aa2750b4d31c
RedLineStealer
9fd2dbfb299190390df123585a1173313973c7ad0ed52cbc28fab95280f816c4
RedLineStealer
a6876f1c666576ddea4b4c4f7d4ade1c98154e3ea63a711beee37bfa9a5467d1
RedLineStealer
dd4053f9eda1802add6d470ebe1e904098bbf47c13d19ee342271da2ad6435bf
RedLineStealer
fb6bc2d81a684ce79e18aac92629f12193f6ebb69652c8d5119daf13f73d3cd5
RedLineStealer
+ 2'264 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:uts discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210925-ltdbtsahfm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.9.20.20:13441
Unpacked files
SH256 hash:
0af5150a5c8f9a5f2678baf604a172626ed229efb82df96d7c358b27eb035b95
MD5 hash:
45b9ad483e9f5647e8f37dc8824d3831
SHA1 hash:
fe09a099996b14eea72674be9a9a6c5963cf7cb8
Link:
https://www.unpac.me/results/b04ea8fb-0630-4207-b4ee-b30f346328ae/
SH256 hash:
2fe3f6fc8b9b9f4d1bddc0e97ddd64229da2a069cf199bcd435d14a3e27e4e19
MD5 hash:
f0f9a9448f7a0494d9bf6e11694bfce0
SHA1 hash:
e3d5c8af3b294813b562fead751cc5c2f5c8a51c
Link:
https://www.unpac.me/results/b04ea8fb-0630-4207-b4ee-b30f346328ae/
SH256 hash:
9fd5a295d9c662d120e8d2688ac4b645c3f4390299e4649b8bf76172f6a66425
MD5 hash:
07e9d4478cddb490f89b0edb4842ab0e
SHA1 hash:
48ea47adc76e29fbb23f8c82c7d1b4761f3216fa
Link:
https://www.unpac.me/results/b04ea8fb-0630-4207-b4ee-b30f346328ae/
SH256 hash:
3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66
MD5 hash:
73149ae2e584b3d3829ea6cd5709035b
SHA1 hash:
3a66126554e7d7e0661ca0c8358941a6709170e2
Link:
https://www.unpac.me/results/b04ea8fb-0630-4207-b4ee-b30f346328ae/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3ec482600f9f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 3ec482600f9fbb506f8a8706dd80d33ef16f0dd7929c7bdfe2b2755ddb059a66

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1582746/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/191489/

Comments