MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf
SHA3-384 hash: 9fe7c91219269a616c7a1a2f2b98e3da99161afd05f2209f0ac2a1c3c5cbb84ea957cbbb218018eef48377f3c16663ea
SHA1 hash: fa5272203481daa7812133ba87c106ef8679d292
MD5 hash: e1e11f79b7a990b4394aeaa56930ad62
humanhash: lemon-hotel-fanta-uncle
File name:e1e11f79b7a990b4394aeaa56930ad62.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:270'336 bytes
First seen:2021-08-18 13:46:03 UTC
Last seen:2021-08-18 15:02:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fac82e460e0af4a20b962e39865b89c2 (2 x RedLineStealer, 1 x RaccoonStealer)
ssdeep 3072:m/vFSGKBoce/4HzgTBrSyEUSXD9xdiEs7/Nrse6HBNQwRxEJoZ3KT0yB3X:gSe/4HzgTAAmJxdiEsue6htWcw
Threatray 1'971 similar samples on MalwareBazaar
TLSH T1F344F15178D1E4B3C096027108B0BBF15A76BCE227A090673BA53BEF5F313D2667634A
dhash icon 1072c092b0381802 (7 x RedLineStealer, 2 x Smoke Loader, 1 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.29:8889

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.29:8889 https://threatfox.abuse.ch/ioc/191954/

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e1e11f79b7a990b4394aeaa56930ad62.exe
Verdict:
Malicious activity
Analysis date:
2021-08-18 13:47:35 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/8b2869c6-f55b-4f1f-ab16-506600765cd5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180333/
Detection(s):
SecuriteInfo.com.ArtemisE1E11F79B7A9.30728.26210.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1bd17b94-9ad7-4bfb-a35d-b447cdf15deb
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/835088
Signature
Found malware configuration
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 13:47:05 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lgyhtp3alxnl6agwl4ugyquviviepxijig7wkgwmhu5i5fsjyc7q._file
Verdict:
malicious
Similar samples:
0144f45fc89447b7bd1bd596e5e8e129a2cff8e4bee793ed460d1da4971b6e36
RedLineStealer
0e568f8920a068d8300b2ef9096c8394cfa77b6002be1692ad3a6fead7e3eb1f
RedLineStealer
186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad
RedLineStealer
3cd0558de9326a38190fc6da0e4df0ab3e4b3b0cca110e0fe083761ad26f4fc2
RedLineStealer
423563995910af04cb2c4136bf50607fc26977dfa043a84433e8bd64b3315110
RedLineStealer
62c10738bd59f6faf4911008b9def1de105a2f5cef9ae1c2ddde9812ea239020
RedLineStealer
679edb212554b93cab86d093150f288010f0b0a71d813f23461ddc1bb8151b13
RedLineStealer
9a9d851d903bd25b1c49617c929da09d822c016648c38f5580fd53849cda3284
RedLineStealer
c1eec495b627d628e570d949dcc165a3457ad38ad17965075ddd228c5955a21b
RedLineStealer
f81b0ee364ffb419c8af7bdaf03670bb7fa7dec30aa1d6f486e7a8157768eed2
RedLineStealer
+ 1'961 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210818-r76cb4dzba/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.215.113.29:8889
Unpacked files
SH256 hash:
9478069a6075be715c8522628753d156c10816fc3b5f89eb98aa160b34db92e1
MD5 hash:
792f7ce7b919e8cd99eecd61e6e04c78
SHA1 hash:
c902c51b212fbbc5640b3636a67f04abd7cfc23d
Link:
https://www.unpac.me/results/fea3596c-0b1b-4ac6-9e9b-aa332fbf0640/
SH256 hash:
c20bf9a202b0a3998821f446a9ba4445ad61f6f9db7ed4f196f4d52babf18169
MD5 hash:
a24c2c9d2094c15460c48f78ad3d4012
SHA1 hash:
aa7f216f323259c42930f67c1d828499f4d71fba
Link:
https://www.unpac.me/results/fea3596c-0b1b-4ac6-9e9b-aa332fbf0640/
SH256 hash:
6beea74184d76a8101e9eccc429a85ccd579bffe86013c6a72db1666291a9fad
MD5 hash:
6bff04629d81b31018f1f09094b10dc4
SHA1 hash:
1705f121a0ebd3cc6e843423d6507025fdd27fe6
Link:
https://www.unpac.me/results/fea3596c-0b1b-4ac6-9e9b-aa332fbf0640/
SH256 hash:
59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf
MD5 hash:
e1e11f79b7a990b4394aeaa56930ad62
SHA1 hash:
fa5272203481daa7812133ba87c106ef8679d292
Link:
https://www.unpac.me/results/fea3596c-0b1b-4ac6-9e9b-aa332fbf0640/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1533784/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/180333/

Comments