MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242
SHA3-384 hash: 3ef219e2c29e71799043c12f867345155c1942eb740a4f00d262d01fab5943d03305a6188c0bfde563b4e0f0dd34cd4a
SHA1 hash: d551e0dd927a240a757ccfcb0540d446eb60f59d
MD5 hash: 75b9806a4dcac3cd2db78ea61f4391e3
humanhash: sixteen-helium-indigo-cola
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:719'104 bytes
First seen:2023-09-21 18:03:01 UTC
Last seen:2023-09-22 00:15:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f15d7c61281219835473a0dcb1929653 (35 x MysticStealer, 5 x RedLineStealer, 3 x Smoke Loader)
ssdeep 12288:j2shISEAQgsPfg64uVQPTpxRFDKofu4vC:j2shIUQgsPfYpJS4a
Threatray 1'013 similar samples on MalwareBazaar
TLSH T1E7E46B21F1A3C2B2DEAA107702ECF561059E99A2A31C69CF57C4CAFBD5203C156395FB
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.169.175.232/autorun.exe

Intelligence

File Origin
# of uploads :
26
# of downloads :
288
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://ferremallasymecanizados.com/net/pass_setup1234.7z
Verdict:
Malicious activity
Analysis date:
2023-09-21 18:18:40 UTC
Tags:
privateloader evasion loader risepro stealer stealc redline povertystealer hijackloader ransomware stop smoke opendir vidar trojan arkei rat asyncrat remote raccoonclipper rhadamanthys oski teamspy g0njxa
Link:
https://app.any.run/tasks/9e8a31bb-cdd7-4c3f-9565-894800435693

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/450481/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.61281.9764.6611.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/650c855833582f234efec7de/reports/bb7599e6-da76-4ee5-936c-fa7e891c24e2/overview
Verdict:
Malicious
Labled as:
Troj/Krypt
Link:
https://www.hybrid-analysis.com/sample/4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/66bb9a85-b4c2-4ba1-9d57-a11dafc3b49a
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1312545
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242/
Threat name:
Win32.Trojan.MysticStealer
Create hunting rule
Status:
Malicious
First seen:
2023-09-21 18:03:06 UTC
File Type:
PE (Exe)
AV detection:
18 of 22 (81.82%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjrdhsis75tjawofxgz2wuxf2ybqgoz32tyq6tvvayrng7awijba._file
Verdict:
malicious
Similar samples:
1b13df7970dd431fb6ffded3d14c2d2874d4296f2be5e802b119e2dbf128dff0
RedLineStealer
4719ed476debe539f2920aebc93035bbbeb7897f8692bbf2115b8639dde710a4
RedLineStealer
845321e0072b6a37c502b6f5992d8e750ac254c3b09c9e55874722fae5ba87d4
RedLineStealer
8df6ff949de778a20deb98bd90e21d9e9449045b73f75cd62c051957997882bb
RedLineStealer
9f78f23917333e4e4ee095e36f159d24d29117296c458b748831d4c0ede6b938
RedLineStealer
b070ba5155d934c38b5726cf96a0764966f6bd35191129730ffe36650fd4932a
RedLineStealer
bb1b75ca2b1cf87a535caf84537badae8ea32f9565c45a8eb955002d708cf258
RedLineStealer
c1d088856f128aa9dbd120f2a727fbb33ae1567caf85d612426345d5e34545eb
RedLineStealer
d2f6db105fe997f60739a7b253dc4d863d35a41105c36bfd16a7a26a5a37b808
RedLineStealer
ed311e8496352c740680e63bb9fd2445f8432a4ca8d47637f37e3588dc475591
RedLineStealer
+ 1'003 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:smokiez infostealer spyware
Link:
https://tria.ge/reports/230921-wm1tnahf8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
Malware Config
C2 Extraction:
194.169.175.232:45450
Unpacked files
SH256 hash:
06ccfcf139d88fff6ec60c4b214002948d83ffabe9ef129a287d470c9113cc89
MD5 hash:
11df5a1b994abac487cbb67c93da9dcb
SHA1 hash:
bb037f77d8c894f57f5e95300de2d5e259ecbcd1
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/42c8b916-f100-4bc8-bff7-098e6ac91172/
Parent samples :
bbac59c3c6a41bfc78a1c6704908d45b0be839280cb7ad41047f870eb298d785
f6ab311f90ea211f69048bb4a809f8adb4a6e02e9d143ef0bd29c8eaad0617bb
0af6821bfe730759d049249d66b09f8b0ba6cae5c5d774ac229b4811b14f7e89
52b4d5ccbf54f79bc94b9779d549e5710a231bcef1cc76b611c21f4e9ad756d0
8a3604b987de66e8a95a64aa7d0f6512b6f8e84d33bba9d5ae712f35212a6cd7
a3cf3e8a2a44ac90b160dc908784b66611258f34a0d00f84c9c80eadd1cf155c
ec53e2555605c5424630d394f6b11677be607c4060ea5772b4afd9ed4f0f94c7
46708920ef342e349ea2368a3a4030da4ea2f441c1415581e9ff0576deb65706
4215352824a635ba671af9c6e265b99ea2a6aca8af16351ec9befa9c6fc5df0f
648f173d9b3a237a978db01181f717f6dbf04720db6f9ff0b3844c0b239e9b85
ea63340c1c1914c476b780cf79e8189c9aa1b38ff6b406f66a3fc630799cb911
9871bad0fe503c40a0eab3cf108ac0a92b390af6ff5022a1760d388719642672
7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294
e90f03124f4c584d8e5a7d8bdf7e99e0255906df3463bda1b04aaa77a8f65aff
70f5ad3b8570e476355717bce4974d7c4dadf850d6ffc6dc2a095be285f7fc90
700985f7c1ac041e2ba3762046f248e88a1d6d96ee043ff45fe83fdc8b5f01bb
a329414a50b9c2444f4ae14baa47b333dd96b1ece4fb6033cc462d2efd2cbfe2
9d717f55876b260cb9dfd43b9c3326ede81d078440b08c06099f64de59b4afe3
63cebbe380cf99272e0d8eb7a3ed9b84633a3eaa048484ab83019b570e711383
4ceda80398f8caee44949b1d3bc77029da005109458a17febf41a0c56bcc8ab1
4719ed476debe539f2920aebc93035bbbeb7897f8692bbf2115b8639dde710a4
4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242
d7a18a9568dbbd0f8d355eff436d3a1ecf48c2784f6b3c692cbcd7829768908d
83af37abbff9157d10d89b307868a2df6c57c22da80bcfa1dc221cb403993890
SH256 hash:
4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242
MD5 hash:
75b9806a4dcac3cd2db78ea61f4391e3
SHA1 hash:
d551e0dd927a240a757ccfcb0540d446eb60f59d
Link:
https://www.unpac.me/results/42c8b916-f100-4bc8-bff7-098e6ac91172/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4a6233c912ff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2706937/
Cape
Cape
https://www.capesandbox.com/analysis/450481/

Comments