MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5
SHA3-384 hash: 1a0e2736d008d03a7eec3ea8919dab58b2acc853e7c59d41a2f70e5f8576f37f4eed8244f05b3f083fe386699f93ccc8
SHA1 hash: 459713a5aa589feac6942bfd61cb64a80e17f446
MD5 hash: 7e87dbce09eb5f6a7009c19d76d8fadc
humanhash: glucose-butter-sad-florida
File name:7e87dbce09eb5f6a7009c19d76d8fadc.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:325'120 bytes
First seen:2021-09-21 13:34:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cc09957b6a7030319b5e28e26ed6a721 (2 x RedLineStealer, 2 x Stop, 1 x RaccoonStealer)
ssdeep 6144:MVTs9f3ZHyLJ0VTfjB7WuXww62W3lATfz3gO2MEi+Bwjtw:KTsxI8fjBjXz62W1ALcbMEi+Bai
TLSH T17264E0017AA0CE73C4934A714B65DBA46676BDB1AC218347AB563B6FFF303C17626309
File icon (PE):PE icon
dhash icon b27e7c7d767e6e76 (3 x RaccoonStealer, 3 x RedLineStealer, 2 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7e87dbce09eb5f6a7009c19d76d8fadc.exe
Verdict:
Malicious activity
Analysis date:
2021-09-21 13:38:36 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/97fea56b-ed6f-45db-8757-2bd9fdb084d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189885/
Detection(s):
Win.Packed.Generic-9895572-0
Create hunting rule

Win.Packed.Generic-9895637-0
Create hunting rule

Win.Packed.Generic-9895679-0
Create hunting rule

Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/50160a61-cf9c-40c7-ab30-db845d7a24df
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/854931
Signature
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-21 13:35:07 UTC
AV detection:
23 of 45 (51.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jiplludx6x2bgswn4q5qptnefpa7anlqx7g3uauj54vpiijnbp2q._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:pub discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210921-qvptgaccer/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.9.20.20:13441
Unpacked files
SH256 hash:
7de1f501c6f4edfbb3e61dda5d445b4482235420e19cd3e193ae3be26d374367
MD5 hash:
858ebd87027f4c3adcb5e2c59ec5161c
SHA1 hash:
f758ceef9690fb7430c910fcffd71c0cdb456834
Link:
https://www.unpac.me/results/c1896813-44e5-4f14-8d4f-a22e2382a659/
SH256 hash:
541526a7b80a64b50c770517545d25c0515a146c3ddc5600a65d91cfdaf5e3a0
MD5 hash:
d964fece1f6eade1b3b0ab1ca479d7e1
SHA1 hash:
cf6948b22255272da7d81e38a936ee90b95c17ee
Link:
https://www.unpac.me/results/c1896813-44e5-4f14-8d4f-a22e2382a659/
SH256 hash:
4e04bba712969aa15782d796bd66233e30de2ceb2fd6f23f8ec88b64b4857636
MD5 hash:
26e6a498e6fdb35574c6a6e51e0b7d1c
SHA1 hash:
394bd2b1362a1fe2fb96cc69971fa08c43bcbf14
Link:
https://www.unpac.me/results/c1896813-44e5-4f14-8d4f-a22e2382a659/
SH256 hash:
4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5
MD5 hash:
7e87dbce09eb5f6a7009c19d76d8fadc
SHA1 hash:
459713a5aa589feac6942bfd61cb64a80e17f446
Link:
https://www.unpac.me/results/c1896813-44e5-4f14-8d4f-a22e2382a659/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 4a1eb5d077f5f4134acde43b07cda42bc1f03570bfcdba0289ef2af4212d0bf5

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/189885/
  
URLhaus
https://urlhaus.abuse.ch/url/1610920/
  
Delivery method
Distributed via web download

Comments