MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c4ca53b4a841b95c0ee07f07599236e53f17998c2b0ecd3c68ffddbf71d29b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	5c4ca53b4a841b95c0ee07f07599236e53f17998c2b0ecd3c68ffddbf71d29b9
SHA3-384 hash:	07ac1cc72b50f218099acba81301c01484255d9cc35975c619f5c6e2ecbca9016eb630b644c495aa2b0212e0fcd829a2
SHA1 hash:	fafb963063f7e1a547f9fc63bee728c3880a24ad
MD5 hash:	abeb4c60d8c8cc9988408c269458f1ef
humanhash:	solar-leopard-autumn-beryllium
File name:	abeb4c60d8c8cc9988408c269458f1ef
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	419'328 bytes
First seen:	2021-06-12 16:02:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ae9cc11fb3f0560dbb76d6972f229f22 (3 x RedLineStealer, 2 x DanaBot, 1 x CryptBot)
ssdeep	12288:0o3HaXkNiIe7OF9kfTyWk0zIY4Sz10GcCLjvAbxZNJ:0o3awqOF9YTyd0z/axGvCXN
TLSH	E4948D10B791C039F2B766F49DB982B8A52ABEB15B2451CF13D52BED87356E0AC31307
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

353

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

abeb4c60d8c8cc9988408c269458f1ef

Verdict:

Malicious activity

Analysis date:

2021-06-12 16:06:12 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/88d75c73-4887-4c1c-8104-a75082d4d016

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/166261/

Detection(s):

Win.Malware.Generic-9870820-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a file in the %temp% directory

Reading critical registry keys

Deleting a recently created file

Creating a window

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b9a7436c-c25b-4fe1-ac51-e6dd7306402f

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/801197

Signature

Antivirus detection for URL or domain

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c4ca53b4a841b95c0ee07f07599236e53f17998c2b0ecd3c68ffddbf71d29b9/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-06-12 16:02:24 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lrgkko2kqqnzlqhoa7yhlgjdnzj7c6myykyozu6gr765x5y5fg4q._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:test discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210612-2npc2mwz1e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

qurigoraka.xyz:80

Unpacked files

SH256 hash:

38cae5e3b0894a743f3bf23796774f53e857bcc73e7f1a62cf777eb43dfae28a

MD5 hash:

f8f34df3e4f16285106ea707123a8914

SHA1 hash:

ff6a58146475696cf1d146983d4d278b5e1cf41e

Link:

https://www.unpac.me/results/d90f2355-26fd-41d2-9122-820e73925446/

SH256 hash:

c53b9d880de0e3331861e5aae97d5ff85d6889da03027ae0a2e711c6cb1e7c1c

MD5 hash:

fa87634071b8b11b2659178cad96c94f

SHA1 hash:

11a214596f54d3648cf3058d805239ffaef40687

Link:

https://www.unpac.me/results/d90f2355-26fd-41d2-9122-820e73925446/

SH256 hash:

c7ab6f04626a9246803ec8feabde356da66e3f45f6de7aa5e2b0ceee1566697b

MD5 hash:

fef56245a6390e2d7045a7d6b6acb218

SHA1 hash:

09c55f3b74e77473d1a034a49e4a85f08b02c7d8

Link:

https://www.unpac.me/results/d90f2355-26fd-41d2-9122-820e73925446/

SH256 hash:

5c4ca53b4a841b95c0ee07f07599236e53f17998c2b0ecd3c68ffddbf71d29b9

MD5 hash:

abeb4c60d8c8cc9988408c269458f1ef

SHA1 hash:

fafb963063f7e1a547f9fc63bee728c3880a24ad

Link:

https://www.unpac.me/results/d90f2355-26fd-41d2-9122-820e73925446/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5c4ca53b4a841b95c0ee07f07599236e53f17998c2b0ecd3c68ffddbf71d29b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.