MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
SHA3-384 hash: 4d1082ad6b29f33791edaea3e6f803125b618dd0d3cff71a755aa8c7e41db4390cb09a85fe4e77912b3f23bde59ac9cb
SHA1 hash: f72f42f7bb22bb5242036b78e5b54f627d22c473
MD5 hash: a6bf1878d4c98c150c65a4f46ce60340
humanhash: music-yankee-social-leopard
File name:a6bf1878d4c98c150c65a4f46ce60340.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:312'146 bytes
First seen:2022-11-13 17:11:39 UTC
Last seen:2022-11-13 18:48:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 81cb68cc20ee69ac5f93f68a2f825c6d (15 x RedLineStealer, 7 x Amadey, 6 x Smoke Loader)
ssdeep 6144:eUgLpjp90jrpL6sz42bqrJiZXU+lpEoZ2v3pCLT0mY0:eUg91qjrlJzCUZXU+7E3v5CLTJP
Threatray 11'327 similar samples on MalwareBazaar
TLSH T11364022279A0C073C60768304869C2E17B69FDF169759687BB8C3F1E6F312D26B66707
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2dac1370399b9b91 (45 x RedLineStealer, 35 x Smoke Loader, 19 x Amadey)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
a6bf1878d4c98c150c65a4f46ce60340.exe
Verdict:
Malicious activity
Analysis date:
2022-11-13 17:12:03 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/7adcaab9-06b2-46f6-aa51-e2e2818215f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/333359/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader45.31457.28448.2197.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/637125675ae98d577068fc39/reports/5cc29849-ad16-4ed9-8291-1d0182296338/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dc136869-5200-427e-a7f9-6cad4ead2eb5
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1112346
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-13 17:12:09 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
23 of 26 (88.46%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m347k3iquq3bhk4g3l2lvk7kasa5goklalyjtbzpeecka5nbeata._file
Verdict:
malicious
Similar samples:
3cf3a0c43f4630fa929fa70533223b46ad5eb4da8d350cf025e1e782921b825b
RedLineStealer
3eac5bbdfde1725766ce68a53713f9977789dfc8f3890f5fd9ef9c622ea13a05
RedLineStealer
53028e41d47860f3e85545cf6f58f69096412c5b0d24cd625f3ecdfb420bcb1d
RedLineStealer
780552fd7cda1cb5ac137f19c30a183a493e2fb923c3c2846a7ffa3c0de506ec
RedLineStealer
80f2e0c027acf95ee54e49a422dfbb1b07edd1701e77ee5de0b6159884c5ade4
RedLineStealer
+ 11'317 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:123 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221113-vqvalsbh77/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
78.153.144.3:2510
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a5d1ad99-8777-4982-be54-4a78e834e312
Unpacked files
SH256 hash:
6efe7fd02d5f6478042dbbe35d7613e2136b9a41acf3e93c0340f2b2ec0186b6
MD5 hash:
6294c16b02fc00aba7f74b89d14a6b5e
SHA1 hash:
f8103857ba2223810975403330f813c3ffbd3f74
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/f7148ac9-eb93-4068-b66c-4c7f0c75518d/
Parent samples :
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
5520de785a54df91deda63975bfea2bce483e8020928aaf8eed5c8ce664f0db2
bbe934a832db11f1f3162fa27be965a88f92b8a25cfe965b6076669d3da8202e
cb30fb7ffcd9881326c240d4b3251d174a578b3ddf56653d276a540890799f97
04a31421bf2de2881d9958bf918c92d1ee988f670ce6200dca8064a6581d33f9
3895be69980fb6b7664e012d102c2e81cbc38de70708d98b3b832236ada6c041
086a34bfeac2c52d33f2d3f04cbba8a549de789c81d6f3fd1ea9c5505e665dea
93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2
f8c1e98bd43ca372b1411738dc5b392a2a41f88093793a17289663ee0fc0406f
a858a5d669f0f5523be8d7e6bca2410b280d4637bcc60a2c468b46b6b70ae8cd
3240455c14048d3813e37e909420e90f7d2afe0a6d73efdf6e6aa7b96b63ebd1
fa6defc9dadc86b3ce81f02e437a24af6b995fb6616a0ecb073b090bdbfd801d
6964a2dc13ce980cd9126100a4fa1bb882b89815eba044a091217e1f9bc9e649
SH256 hash:
c9638104c213938fc16795163bdc0faf71f8507afbc2d8f581a0523724514758
MD5 hash:
c01706a812e7540617dbcc6e76456947
SHA1 hash:
e3d147be06d724d2b6c87c99306805256b1d8212
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/f7148ac9-eb93-4068-b66c-4c7f0c75518d/
Parent samples :
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
bbe934a832db11f1f3162fa27be965a88f92b8a25cfe965b6076669d3da8202e
04a31421bf2de2881d9958bf918c92d1ee988f670ce6200dca8064a6581d33f9
3895be69980fb6b7664e012d102c2e81cbc38de70708d98b3b832236ada6c041
086a34bfeac2c52d33f2d3f04cbba8a549de789c81d6f3fd1ea9c5505e665dea
93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
a858a5d669f0f5523be8d7e6bca2410b280d4637bcc60a2c468b46b6b70ae8cd
SH256 hash:
8e4a9fc9820dfc3fdfc793aec3676d06b5b4ebfe512a62eb4a9032d0735f775c
MD5 hash:
42cfadd8c7cac115b2813dcdc145f5ec
SHA1 hash:
1d6d4f6cc24dcf3dde14a8ea4c9a6930447d044d
Link:
https://www.unpac.me/results/f7148ac9-eb93-4068-b66c-4c7f0c75518d/
SH256 hash:
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
MD5 hash:
a6bf1878d4c98c150c65a4f46ce60340
SHA1 hash:
f72f42f7bb22bb5242036b78e5b54f627d22c473
Link:
https://www.unpac.me/results/f7148ac9-eb93-4068-b66c-4c7f0c75518d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/333359/

Comments