MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2
SHA3-384 hash: 600bad9105b4fe2c342839bde9c10825bff83d0eb28b915416a0be9de2304404d77a1ea773408430698802486c868cf4
SHA1 hash: 3619dc78eccf8c4576a1bdc89c13c8614c393ee7
MD5 hash: 0db483b7dcecb0c1e919849e83bbe6c9
humanhash: march-juliet-victor-angel
File name:0db483b7dcecb0c1e919849e83bbe6c9
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:378'368 bytes
First seen:2021-06-18 08:29:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8b2fca54d55baca0ec5c91e48a9328a0 (1 x RedLineStealer)
ssdeep 6144:O8K4jPZPQSOyOekI7VZUD/k+KxIapXidiZSftRfgp/xDcOhdE2piR:O8K4jPZ4SOyO2VgExLIicvgBRXYR
Threatray 2'496 similar samples on MalwareBazaar
TLSH 63849D11A7B0C034E6F213B49A7982F9952E7DA07BE490CF72D527EA6674AE0DD30317
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0db483b7dcecb0c1e919849e83bbe6c9
Verdict:
No threats detected
Analysis date:
2021-06-18 08:29:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/49b88692-0fd3-481a-86f7-e7262fddfabe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/166799/
Detection(s):
Win.Packed.Filerepmalware-9869115-0
Create hunting rule

Win.Packed.Filerepmalware-9869146-0
Create hunting rule

Win.Packed.Filerepmalware-9869183-0
Create hunting rule

Win.Packed.Ransomx-9869238-0
Create hunting rule

Win.Dropper.Raccoon-9869289-0
Create hunting rule

Win.Packed.Pwsx-9869364-0
Create hunting rule

Win.Malware.Ransomx-9869408-0
Create hunting rule

Win.Packed.SmokeLoader-9869172-1
Create hunting rule

Win.Packed.SmokeLoader-9869196-1
Create hunting rule

Win.Packed.SmokeLoader-9869198-1
Create hunting rule

Win.Packed.Redline-9869230-1
Create hunting rule

Win.Packed.SmokeLoader-9869248-1
Create hunting rule

Win.Packed.SmokeLoader-9869383-1
Create hunting rule

Win.Packed.Pwsx-9870269-0
Create hunting rule

Win.Packed.Raccoon-9871119-1
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/65ac5203-c443-4811-9d8d-d4e820bfa776
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/804217
Signature
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 06:49:52 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jr22hvj2htzdrfyizbutspuo3m2kqf56suc3n7vkylupjfory7za._file
Verdict:
malicious
Similar samples:
0c0f298ef912b9bcd172a997fd89829b4917e91e92dfbda6135b16a0464229e6
RedLineStealer
453debcca834d384581837da8253ac5f4e2eaf7fc641407081d1e7cf57bc4266
RedLineStealer
475fb56e0d04331b71ef82cd98e61b377a8ece08a57345f18806fd367718bbc2
RedLineStealer
63c9bab720391433d6195ee41da8a049281f5c8e2ea20d074961bf31b93986a0
RedLineStealer
8d2c0894f593f9f8e00a72fe904b32f5437e4448f485ac2867806d4458f0b713
RedLineStealer
96802cd1e7ee797e260cf5379cdd8526379b6ab1c396c21f1db1dae4ca111e93
RedLineStealer
9f3059cd216e4310893b76812fac2bd3b203a592e5604347472b71ada0150855
RedLineStealer
b2e0c72237dbad9cbd82ec93814b1b078779d3016d4e7d18b7bd5ff2cdeb9c68
RedLineStealer
b479768bf30303be4d80d2ec21ea1a5cb116307e7c637a562b28c019acd515fa
RedLineStealer
ec51c1a42099d2ebcb00e68608346ac14013c57f5a87713f6ab41b17c305b537
RedLineStealer
+ 2'486 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:mix2 infostealer
Link:
https://tria.ge/reports/210618-w1ltsvhf7n/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine Payload
Malware Config
C2 Extraction:
194.156.67.100:48883
Unpacked files
SH256 hash:
9eb624f017f17c8b8c2557d9db6ada8ac15471b5a00632d9becbd32d4da610a9
MD5 hash:
a75be83de22a24d4d1c3739657c0d7bc
SHA1 hash:
e7b16b6f2344c239b917f60eb88b30313b2c24a3
Link:
https://www.unpac.me/results/440c63aa-2d17-4b59-a63f-b4fafedab0fc/
SH256 hash:
4362c9145ad0b3d2cab4f8838390a8b83909fcb4933f7b00fb63a33b83d09116
MD5 hash:
eb0315e9c6759a6d2cd63eed132d9d95
SHA1 hash:
472f1b78c7b0392798dafe7b4ca3bc4bc26d7a0a
Link:
https://www.unpac.me/results/440c63aa-2d17-4b59-a63f-b4fafedab0fc/
SH256 hash:
ac1da29c05a880adf1713f24a9c6a209a7d88f8a62ac02e1cd8667e93f83be3e
MD5 hash:
51e0dab48d82107745d1e1faa5fe24e1
SHA1 hash:
09ad526b91e76670f53e07b02bf47fe708b85205
Link:
https://www.unpac.me/results/440c63aa-2d17-4b59-a63f-b4fafedab0fc/
SH256 hash:
4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2
MD5 hash:
0db483b7dcecb0c1e919849e83bbe6c9
SHA1 hash:
3619dc78eccf8c4576a1bdc89c13c8614c393ee7
Link:
https://www.unpac.me/results/440c63aa-2d17-4b59-a63f-b4fafedab0fc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1375518/
Cape
Cape
https://www.capesandbox.com/analysis/166799/

Comments