MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c6ce925956ff002d7f3f533d18cdd06384f8d48998c49a9bfec4ce490971f14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	5c6ce925956ff002d7f3f533d18cdd06384f8d48998c49a9bfec4ce490971f14
SHA3-384 hash:	e6518b0da0a2300104f35a5728682241df3902e912e37a5eab732dc96fec8a49a32aa969f3c7919d9facf81b9ff3db06
SHA1 hash:	5a51a9cf5d60ce6d57191ede2c48b228595ef88e
MD5 hash:	6b42c5556d260f1d833328d2443ac7d4
humanhash:	white-indigo-five-winter
File name:	6b42c5556d260f1d833328d2443ac7d4.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	366'080 bytes
First seen:	2021-09-23 06:02:28 UTC
Last seen:	2021-09-23 07:23:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	077da89a12148c6ee034067c75e2bb0f (5 x RedLineStealer, 1 x Stop)
ssdeep	6144:y3Z025Ckib5c+TzQ81PcKIKIYKA+ph9yz+/SrYfXfS:+Z025CkibTzj8iiS0
Threatray	6'326 similar samples on MalwareBazaar
TLSH	T1B974BE10B6E0C034F6F712B949B5D3B4A93E7EB1AB3485CB62D116EA56746E0DC30397
File icon (PE):
dhash icon	ead8ac9cc6a68ee0 (93 x RedLineStealer, 50 x RaccoonStealer, 15 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6b42c5556d260f1d833328d2443ac7d4.exe

Verdict:

Malicious activity

Analysis date:

2021-09-23 06:04:25 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/b7dc1de7-fbc5-4617-a435-bb730a7539a1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/190472/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.37629278.24489.20672.UNOFFICIAL

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/83a4b0a0-1e3c-49b5-81c5-c4310c442b2a

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/856175

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c6ce925956ff002d7f3f533d18cdd06384f8d48998c49a9bfec4ce490971f14/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-09-23 02:48:00 UTC

AV detection:

12 of 27 (44.44%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lrwosjmvn7yafv7t6uz5ddg5ay4e7dkitggetkn75rgojeexd4ka._file

Verdict:

malicious

RedLineStealer

4023763ad7b1f3cae1395dcfbfb15317c006526c355914ecf7d8506696e3b1ce

RedLineStealer

6ad1cf3b42e1c571f6a7a402ad29e289ea119a6929345660a98e2786a3ddace4

RedLineStealer

8498f560c45b7d2db3427aaf5a481a4e584a1aa8f59767147e895b60e08286cf

RedLineStealer

8ed4276b7bd2b1c80107c6817a5d18fdd9a88e6c69a5f8fbc0613fd682cbe744

RedLineStealer

df1f97bc36b16e89492eac798745c9427681c448aad6bc5398cb32d1f3c96891

RedLineStealer

ebfe4a01a842ddcf434e44a288773454c4c5c35602a5fba3a31e47ff010a1314

RedLineStealer

f2dcef55206cf3f02557e31f850db63330d849374956cb581bd9b016803907d3

RedLineStealer

+ 6'316 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:udp discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210923-gr18nahebm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

90b0e7d902727351e4a88f3b02c2d3d15d202b2a0ea118c961c21c258617c1cf

MD5 hash:

6ac070b383c57c84bce059f1611a8bc0

SHA1 hash:

f8768f72c0cc63945cbe31b75e39a9d207db06b5

Link:

https://www.unpac.me/results/21a123f2-6371-4fa1-9aeb-fc06edd63bc5/

SH256 hash:

74ec8e7f6661e87226bb95a4ba97ae828c45f3142b78d068492cff7162bbbd47

MD5 hash:

f007c18cee4cbdd6992122a8a216ccc0

SHA1 hash:

5b931b76947bb4484ae7b94a60e83c65f92b21b3

Link:

https://www.unpac.me/results/21a123f2-6371-4fa1-9aeb-fc06edd63bc5/

SH256 hash:

fc667313899f6647f9d67a16af1234ac6b109223b7c3ce0d178614985cfd27e9

MD5 hash:

24eb234842defb045592109e300bed32

SHA1 hash:

4fa3017ddf932a7f7ae7fbbeda7eacbea609f283

Link:

https://www.unpac.me/results/21a123f2-6371-4fa1-9aeb-fc06edd63bc5/

SH256 hash:

5c6ce925956ff002d7f3f533d18cdd06384f8d48998c49a9bfec4ce490971f14

MD5 hash:

6b42c5556d260f1d833328d2443ac7d4

SHA1 hash:

5a51a9cf5d60ce6d57191ede2c48b228595ef88e

Link:

https://www.unpac.me/results/21a123f2-6371-4fa1-9aeb-fc06edd63bc5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5c6ce925956ff002d7f3f533d18cdd06384f8d48998c49a9bfec4ce490971f14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.