MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 417a617e475f6b543a3b5a7639147c73abc059e50c19a983e6ba28067a74c1aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	417a617e475f6b543a3b5a7639147c73abc059e50c19a983e6ba28067a74c1aa
SHA3-384 hash:	3e920dd5856f784a094400f48e2fb0750fff52abd817f76dd3618c28e187503a038e04964bed78e83585eb941e48f232
SHA1 hash:	89e6188a88e4b46eac75ab530536a69c9830f503
MD5 hash:	896477519296ee090104d1b9dbfb3bd9
humanhash:	alaska-avocado-uranus-blossom
File name:	896477519296ee090104d1b9dbfb3bd9.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	359'424 bytes
First seen:	2022-03-24 19:11:58 UTC
Last seen:	2022-03-24 20:42:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f3e2f2b52a9345b2bd8582942ee5c776 (11 x Stop, 7 x RedLineStealer, 2 x N-W0rm)
ssdeep	6144:q+rCCCyrqywaoELbrMGXMUDjFGgYnJoN8NRBKB:q+eyFoEL/rlkJo6Jo
TLSH	T1857412317742F071C446913135AACBE0761EA83217A208577BC9276B6F725C1F6F6B4B
File icon (PE):
dhash icon	5c59da3ce0c3c850 (12 x Stop, 11 x RedLineStealer, 8 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

215

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/257332/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.11316.18229.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Sending a TCP request to an infection source

Stealing user critical data

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/11185/overview

Behaviour

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/623cc29db94fb38cb4e5752f/reports/df6fdbc1-5465-4df7-a2ed-0104bef3f317/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3acc356e-5dca-469f-bee3-3a401ec84f3e

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/964028

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/417a617e475f6b543a3b5a7639147c73abc059e50c19a983e6ba28067a74c1aa/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-03-24 19:12:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=if5gc7shl5vvior3lj3dsfd4oov4awpfbqm2ta7gxiuam6tuygva._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:sewpalpadin infostealer

Link:

https://tria.ge/reports/220324-xwjr6sdcc4/

Behaviour

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

RedLine

RedLine Payload

Malware Config

C2 Extraction:

193.233.48.58:38989

Unpacked files

SH256 hash:

d60a653b5d3d6cf4ae6f1539ae05312d91f67b12bd559653cabaecc131ac071c

MD5 hash:

e1cb1a74bd7a8b8aef3e35fe23ab3557

SHA1 hash:

ee461d7c8e18dd150e0ee607a036da61f478a5fe

Link:

https://www.unpac.me/results/bad05ef9-38c5-4f43-8f9f-461752de6c71/

SH256 hash:

4f2231f29e06809d9442b1ce8535b6a0610c23a7baafc1c6c96a83281a4ec13a

MD5 hash:

de667cc858a905e6c3c7ad23c0356d24

SHA1 hash:

cec9d8efa8873eca0824d35906ef784a990b2ed7

Link:

https://www.unpac.me/results/bad05ef9-38c5-4f43-8f9f-461752de6c71/

SH256 hash:

577006471b98395e407abea2739adf073654ebd5292ed12a1a76a12258b67b39

MD5 hash:

7b61a29887a66e0f37b2daba1a368f2e

SHA1 hash:

4cbba3c48e47c540c1f77c28b63be662084b5ab3

Link:

https://www.unpac.me/results/bad05ef9-38c5-4f43-8f9f-461752de6c71/

SH256 hash:

417a617e475f6b543a3b5a7639147c73abc059e50c19a983e6ba28067a74c1aa

MD5 hash:

896477519296ee090104d1b9dbfb3bd9

SHA1 hash:

89e6188a88e4b46eac75ab530536a69c9830f503

Link:

https://www.unpac.me/results/bad05ef9-38c5-4f43-8f9f-461752de6c71/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/417a617e475f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/417a617e475f6b543a3b5a7639147c73abc059e50c19a983e6ba28067a74c1aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.