MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
SHA3-384 hash: 5ec88263b3938db3f8d924a3f12f4481506aa9b48dbc8f29428157c506745096f59da0c217132988f487b8e134068756
SHA1 hash: 282e5a849c213ad3b797f1a14f1ab8d7c7ecc163
MD5 hash: 15b5e2430a20ca3a97c96259323931e4
humanhash: music-kitten-sodium-august
File name:15b5e2430a20ca3a97c96259323931e4
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:434'688 bytes
First seen:2023-02-03 03:51:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8da36f6dce34183aedb624e434f46f7f (11 x RedLineStealer, 6 x Smoke Loader, 5 x Amadey)
ssdeep 12288:YInoCaB/Nm38qc2cYOPca63R93t2KeXDleN:Z41m38CcYOPchRj2pDleN
Threatray 15'363 similar samples on MalwareBazaar
TLSH T15C94AF42A392FC51DA21CA329E1FDBF87A1DF5918E287F6652585B3F1872173C5A3320
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2484848880948cc0 (1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
15b5e2430a20ca3a97c96259323931e4
Verdict:
Malicious activity
Analysis date:
2023-02-03 03:53:47 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/b8516d22-4b8c-4718-bde4-8f116f968af2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/359726/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63dc84e21c9cbf7d62557fb2/reports/64e26806-fff1-42c1-b1e8-fe8d4f0427bd/overview
Verdict:
Malicious
Labled as:
Ransom.788A61AA
Link:
https://www.hybrid-analysis.com/sample/57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/627b58e1-57c3-4d92-839c-7a3ecbdfd04a
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1164807
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2023-02-03 03:52:08 UTC
File Type:
PE (Exe)
Extracted files:
86
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6tdbnay4mla5ve4pipnpxna6wnwtsmxxh3e2y4tqiqyxzdht2vq._file
Verdict:
malicious
Similar samples:
3daa3a818177dfaa9ac7f7d5e700d44ac3a11b4f0da40962d08e2c85925801e8
RedLineStealer
6acee31b7d70a5d29bd227366ca6ff41aa3f40086fcb6cdac93181bbb4052bf8
RedLineStealer
755cee37572cd6adec4750735f2a6fd9cdb15dcf3c988d49771a1f5772b51705
RedLineStealer
a3727adaf2de6bae0a02b458c1d6477efaa333e32e26ff9ca59274af216ccb2e
RedLineStealer
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
RedLineStealer
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
RedLineStealer
de1c0019ba6049f083253597fa8b05028fd13c99c604896ab52a80d8fc436a1b
RedLineStealer
+ 15'353 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:2-2-2023@ discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230203-ee283sae96/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
91.215.85.155:32796
Unpacked files
SH256 hash:
02d15cc70446bda384a483ed4d81e5fd4bf7a2c5848ea5ec355fa693dfff8503
MD5 hash:
b95cc5ff84e75ce7bbc38edf9f0746fa
SHA1 hash:
a3c4b7ea0200305a45cd6214ec63ec6948dfb6b8
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/51c2a07f-2e86-4f38-b51b-b2aad839c9c7/
Parent samples :
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
5243496a6317fa28696043916abcda8a598d9e4b3d101a04d8eb33c8f998d227
MD5 hash:
fa49d962de59c209b6f269007a1dfb49
SHA1 hash:
322a177a0031221ebec3dc788166e4946363f830
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/51c2a07f-2e86-4f38-b51b-b2aad839c9c7/
Parent samples :
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
a09bb30e4ac852eeb4fbfe3c4900606f83775936b6be3c175c4dc773376a273b
MD5 hash:
135d8693f5bddda089165c5d0461cf8e
SHA1 hash:
0b93c573787c2bbd9f6dc0a5aecacd95d271d3de
Link:
https://www.unpac.me/results/51c2a07f-2e86-4f38-b51b-b2aad839c9c7/
SH256 hash:
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
MD5 hash:
15b5e2430a20ca3a97c96259323931e4
SHA1 hash:
282e5a849c213ad3b797f1a14f1ab8d7c7ecc163
Link:
https://www.unpac.me/results/51c2a07f-2e86-4f38-b51b-b2aad839c9c7/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/57a630b418e3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2440457/
  
URLhaus
https://urlhaus.abuse.ch/url/2498781/
  
URLhaus
https://urlhaus.abuse.ch/url/2403396/
Cape
Cape
https://www.capesandbox.com/analysis/359726/

Comments


Avatar
zbet commented on 2023-02-03 03:51:30 UTC

url : hxxp://194.110.203.101/puta/softwinx86.exe