MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments 1

SHA256 hash:	50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3
SHA3-384 hash:	148efc3a25cc600a1d59fccd97dc31a5f5e76a9984338f0a0e6c27c61966ff9caf5df5817a143f2141d87d069ec17379
SHA1 hash:	be0ec6271f20578ffb2523a8b5c2d3fbf07949e5
MD5 hash:	b9e6d401a63b2ed2a60380307506edb8
humanhash:	may-maine-spaghetti-mike
File name:	b9e6d401a63b2ed2a60380307506edb8
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'398'784 bytes
First seen:	2022-06-22 06:04:17 UTC
Last seen:	2022-07-22 10:46:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	83f451221b14b5f6dfd7a86d751b2d31 (1 x RedLineStealer)
ssdeep	24576:iPSjR+0vXad/ELUwRm3Kcpek/paBwkgUFBHLgD5gzyeI:S9Mk/paBwkfLM5gK
Threatray	4'014 similar samples on MalwareBazaar
TLSH	T14955BF03B5ADC873C93231B706BA52B25ADDB4706A54619F33CDCE3EEA67880471672D
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

215

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/282179/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Steam.28157.1952.28318.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/22257/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/62b2b115924ee6692337fe2e/reports/9861d833-9500-49a5-a441-89b019e1e83d/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6e7ae5af-19ca-4a9c-991c-784a69fc3069

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1017650

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2022-06-13 10:59:22 UTC

File Type:

PE (Exe)

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kd7jpyxna6qbmizymdw63u3oi7ahpbl5fmklsgncdjpysksdf2rq._file

Verdict:

malicious

Label(s):

cloudeye

RedLineStealer

37e057a9cf268da296c33ea6e935d1008b018cc51752143618577b3b9a2a26ee

RedLineStealer

bf6e888a13ccae43e32998d51bf274d14aa5012de228116ceb04826e4330e510

RedLineStealer

c88b1375ab69fe304482d67458825086eb304fb7fc19ba9def6a0b9d12b8a4aa

RedLineStealer

ee1cca8c757ee3dd610c9d6ea361610cca20f2b6369ed06ffbc3349f4a7f901a

RedLineStealer

+ 4'004 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:76 infostealer

Link:

https://tria.ge/reports/220622-gs6vjabdc5/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

139.99.32.83:43199

Unpacked files

SH256 hash:

e9a585442380feaa4c7ca9b7c4bdd01eff5e29e257f646a584e02c1059c5fb8c

MD5 hash:

83c14dc83f73039dbba9ba4a70a920cf

SHA1 hash:

0c245016063910e7dcc5303066382ee60ab29609

Link:

https://www.unpac.me/results/713e19a9-b5fa-4932-93a5-3f0071ca9505/

SH256 hash:

50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3

MD5 hash:

b9e6d401a63b2ed2a60380307506edb8

SHA1 hash:

be0ec6271f20578ffb2523a8b5c2d3fbf07949e5

Link:

https://www.unpac.me/results/713e19a9-b5fa-4932-93a5-3f0071ca9505/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.