MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876
SHA3-384 hash:	355babae95da426fed34b08c413b21a960752b778a340c35264f62af8e52b176f59bb20abaf28f033718f9ee25f1750b
SHA1 hash:	6b445db03cb992ac6ef9acffc3e9531fc0938ba0
MD5 hash:	d99493664128a477b7afe8808daf4f42
humanhash:	beryllium-bravo-helium-maine
File name:	file
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	172'308 bytes
First seen:	2023-11-21 14:10:43 UTC
Last seen:	2023-11-21 15:18:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d5699061d49d1552d5c68695d71af56d (1 x RedLineStealer)
ssdeep	3072:5q4IflfIRxGKy2mzrQVYIk3++O2J/dG7OJ5lruJk4eK1:5qflmB++RL+O2J/gaJ5mMK1
Threatray	57 similar samples on MalwareBazaar
TLSH	T128F39E247C5C8022CC46DA7C5FBF8F1497AFF979B2F2928923659E51EB02B7C512A314
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	jstrosch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

329

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-11-21 14:12:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b9a929dd-676a-487a-8741-8ed2e42eaeb3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/459550/

Detection(s):

PUA.Win.Packer.Ep-7

PUA.Win.Packer.Embedpe-3

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Stealing user critical data

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/655cba860e54ca1845c52659/reports/0bb0050c-1fcb-42c4-84a4-4c0c4aac1cff/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

WeeLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2e40d596-2b1c-4264-a24c-7034b3a19951

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1345844

Signature

C2 URLs / IPs found in malware configuration

Connects to a pastebin service (likely for C&C)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-11-19 04:35:05 UTC

File Type:

PE (Exe)

AV detection:

18 of 23 (78.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h72ps3757sh4njx4lcuvtvucxsobvd3ddbysc7usjwcaopd75b3a._file

Verdict:

malicious

RedLineStealer

3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876

RedLineStealer

5a5a392f1ac3ed032255fb484266319c42da2468bd0e1fbf7ec74ef39d5e17af

RedLineStealer

a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400

RedLineStealer

aa23c8b6468593d23f9e186b7d377a6136a2cd6cf6ebe7e927101b36fe9bf22b

RedLineStealer

ba2e9c9f33c7d6462eb951c0aafdaa5419e588cbf141211e2fa93b741bebbb44

RedLineStealer

d2df430d281ad78bc0690d63df9896fe195e2df53f2e9182c6f459094f70aa45

RedLineStealer

+ 47 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:5637482599 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/231121-rhaz8aff8v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Reads user/profile data of web browsers

RedLine

Malware Config

C2 Extraction:

https://pastebin.com/raw/NgsUAPya

Unpacked files

SH256 hash:

8303b8983ed5f1ad8a53d4629c02cebd9c067d1976712c03d80cc4e3846f42ce

MD5 hash:

ee36084695d41b2a997306c3ff332083

SHA1 hash:

2e828257dc559fffea51d7c51a07140ce80aa644

Detections:

redline

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/f8adf114-001f-4845-ae76-340afdeed7de/

Parent samples :

1155b82749364016f6a7232f58f169029706bf61da9e19d97b015eca502e3396
aa23c8b6468593d23f9e186b7d377a6136a2cd6cf6ebe7e927101b36fe9bf22b
3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876
10480736752fc02e4c2360e1a3066a494c17db9db6709b5d6621d5f2e9ea922d
3467893f47bdbaa0fb58975fdce620c2591a2064703f56fab29313afa3fe9cff
297e3d063b460078308a5c84bb86b13c9bb878a47d02446b0a1ecc25b690e3eb

SH256 hash:

3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876

MD5 hash:

d99493664128a477b7afe8808daf4f42

SHA1 hash:

6b445db03cb992ac6ef9acffc3e9531fc0938ba0

Link:

https://www.unpac.me/results/f8adf114-001f-4845-ae76-340afdeed7de/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3ff4f96ffdfc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 3ff4f96ffdfc8fc6a6fc58a959d682bc9c1a8f631871217e924d84073c7fe876

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/459550/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample