MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
SHA3-384 hash: 7d87394f94e7dcf0264558c31385be33aed754e36da6fe6b65b592a2f36e0a4fb6edd491f573d8fcf6cb76ff75e5b92a
SHA1 hash: 8e12857a34c65b0c2a918cbff6579930b57144a3
MD5 hash: 998f6fe3d927dabe2a1534f9f3afdbe5
humanhash: double-august-cat-october
File name:998f6fe3d927dabe2a1534f9f3afdbe5.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:463'872 bytes
First seen:2022-11-02 07:05:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ebd17a13b40f108ded2cb86c03ee706 (6 x RedLineStealer, 5 x Amadey, 4 x Smoke Loader)
ssdeep 6144:I8TkdzYCxJPmDZ9OAc0PMD27z8MqGUwmddwUpSlhKu7ITsqF:I8AzYCHM0HaMDDMqGUwIdRpKKu7c
TLSH T172A402E174E0C432C09778348920CFA0BA7BB921D5285A4B7B74376E5F313D266BA757
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon b0b1b17968ecced6 (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.24:47242

Intelligence

File Origin
# of uploads :
1
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
998f6fe3d927dabe2a1534f9f3afdbe5.exe
Verdict:
Malicious activity
Analysis date:
2022-11-02 07:07:23 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/18a77833-3ee8-41ea-bb4c-d00bb5d80af2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/327008/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.23137.17195.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connecting to a non-recommended domain
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/636216e2ce1f43143c2a6849/reports/793bc09c-bacf-4586-86bd-462e615d076c/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c3923017-8638-4ef0-8a00-65a6c9cc6250
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1103006
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-02 07:06:20 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m4a733mdda5oejuw5ipxvhwkm3gk4gyitzzyap74itru3rppum7a._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:dozkey discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221102-hw34gsaah7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
193.106.191.24:47242
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/48e790c4-32b9-4223-83f4-af67b6881d57
Unpacked files
SH256 hash:
e5d6957ed2d1dd8c8d2e94297ac49c67dce7b1969ca0e7ed719f352083232a7b
MD5 hash:
67f69dcc34c67ff5297c5e7bdcdf82cc
SHA1 hash:
79d986e6837eb62c1113bef9a7d95294fb5e1bd9
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/2b6000fb-2f51-474e-b3f8-0d1882fa8cd4/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
294794b4e480bfaf0f96bff492d33c115a47d07c7b727618ca61f092d0f93096
MD5 hash:
2cb65c4dd615432dfcad784a2d3184c9
SHA1 hash:
5f7069d73db72c4786b5f88b7ebeb1b6adafd5a2
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/2b6000fb-2f51-474e-b3f8-0d1882fa8cd4/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
ab53c1842d525b940656ef13277dcc83f1dc1d42cdc2f1172f786e9ae76421c5
ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
af669fa4f200fcc0c00d9aea49027d3d2ace15d6b055156195cf05ee6cd7906d
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
fd5e4d6282eb852549b996ab98aef3bc22c7f6e053a4fdc742b767daa801024b
MD5 hash:
8c982caea354e82103b3a9d4f4e60ae9
SHA1 hash:
4635f41b7a6fa18c4d09dc8416aa1a00c6dbdb10
Link:
https://www.unpac.me/results/2b6000fb-2f51-474e-b3f8-0d1882fa8cd4/
SH256 hash:
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
MD5 hash:
998f6fe3d927dabe2a1534f9f3afdbe5
SHA1 hash:
8e12857a34c65b0c2a918cbff6579930b57144a3
Link:
https://www.unpac.me/results/2b6000fb-2f51-474e-b3f8-0d1882fa8cd4/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6701fded8318/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2384053/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/327008/

Comments