MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 14
| SHA256 hash: | 518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff |
|---|---|
| SHA3-384 hash: | 2bf3f4032e101d36776ed4be1f63013f5268e48d54386c29120581935e5fd8fe12610bca08f563ee36a525b0fbcde3d6 |
| SHA1 hash: | ec277b865f788289b731a5cc8dc80a7cb2b551ba |
| MD5 hash: | 9c88149795222b21389b93b69edcc3c7 |
| humanhash: | august-freddie-helium-ack |
| File name: | file |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 409'600 bytes |
| First seen: | 2023-02-02 12:00:39 UTC |
| Last seen: | 2023-02-02 12:59:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 20540b45038474bafe70cf1c181e44fd (6 x RedLineStealer, 4 x LaplasClipper, 2 x Smoke Loader) |
| ssdeep | 6144:poXL3apNcz6ztuFOO2N+keTg0ZP1twYGBB9/CJTk637eQfnd5VphB:QDqJztQ2AkeM0Z6v9CJb7d5V |
| Threatray | 15'273 similar samples on MalwareBazaar |
| TLSH | T1D894AF42B2A0FC49E9358B728F1EE6E47A1FF9504F3D77B61224AB1F14731A1C962325 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 284c048884848480 (1 x RedLineStealer) |
| Reporter |  andretavare5 |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
27
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-02-02 12:02:06 UTC
Tags:
trojan rat redline
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm greyware packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RedLineStealer
Status:
Malicious
First seen:
2023-02-02 12:01:07 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 15'263 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:2-2-2023@ discovery infostealer spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
91.215.85.155:32796
Unpacked files
SH256 hash:
02d15cc70446bda384a483ed4d81e5fd4bf7a2c5848ea5ec355fa693dfff8503
MD5 hash:
b95cc5ff84e75ce7bbc38edf9f0746fa
SHA1 hash:
a3c4b7ea0200305a45cd6214ec63ec6948dfb6b8
Detections:
redline
Parent samples :
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
3e3ba87662306453fe06acc01775d04e54c3ec4a14eeac2b865b06ddf26e5fb0
MD5 hash:
b90eb1c5816c56a2564ee8b51ed38ebc
SHA1 hash:
259c4a7239df33595f4e206d57a8fc329f3be124
Detections:
redline
SH256 hash:
a09bb30e4ac852eeb4fbfe3c4900606f83775936b6be3c175c4dc773376a273b
MD5 hash:
135d8693f5bddda089165c5d0461cf8e
SHA1 hash:
0b93c573787c2bbd9f6dc0a5aecacd95d271d3de
SH256 hash:
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
MD5 hash:
9c88149795222b21389b93b69edcc3c7
SHA1 hash:
ec277b865f788289b731a5cc8dc80a7cb2b551ba
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
| Rule name: | Windows_Trojan_Smokeloader_3687686f |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Dropped by
PrivateLoader
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.