MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 3

Intelligence 3 IOCs 1 YARA 6 File information Comments

SHA256 hash:	6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e
SHA3-384 hash:	a11ac3c5f16485b7faab0b1e038a43262e3540859fb934404e22014e55b9e2e858e1000838a2727a01e8818b2dad904f
SHA1 hash:	383a12a90e3601636c47936d79ca60288e4ce120
MD5 hash:	dd9f3e29ea5c2d60fa0405a6212d25c8
humanhash:	east-salami-montana-blue
File name:	Evolion.rar
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	19'176'798 bytes
First seen:	2023-07-06 17:16:50 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
Note:	This file is a password protected archive. The password is: EvolionGame
ssdeep	393216:g2EJXPMuGsFOTXH5yFyDYV2mis6HesitrrE562r0MoFk+fPdH1eS:g2EhhGsFOTXL0VoyrEk2r0MyPdVF
TLSH	T16E17331A9ED5EC9ED9DAEACB8CBC2CEC354F6C087075DABE20049750966476311E4CCE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	iamdeadlyz
Tags:	FakeAvania file-pumped pw EvolionGame rar RedLineStealer

Iamdeadlyz

Fake Blockchain Games Deliver RedLine Stealer & Realst Stealer - A New macOS Infostealer Malware
https://iamdeadlyz.gitbook.io/malware-research/july-2023/fake-blockchain-games-deliver-redline-stealer-and-realst-stealer-a-new-macos-infostealer-malware

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
78.153.130.209:29996	https://threatfox.abuse.ch/ioc/1109524/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: EvolionGame

This file archive contains 20 file(s), sorted by their relevance:

File name:	oo2ext_7_win64.dll
File size:	1'223'680 bytes
SHA256 hash:	23bb4eb079a00c2d583472e11e4d36188ba1b365bf115f8a33cb53d18a319908
MD5 hash:	7abaef6738a3d2b44db627640bbd71cb
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	d3d11on12.dll
File size:	1'560'144 bytes
SHA256 hash:	4a18ec60416f58ef2a4c5ce7a5f7f9b1d1577746dfbd50c3a348c8e40900263c
MD5 hash:	d038160637333d2316480fc9e9e00429
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	CrashReporter.exe.config
File size:	203 bytes
SHA256 hash:	cba408de5cfa35c0cf053e0a9869bbda50bc21c8b84a53790368a19788e72c3c
MD5 hash:	e15e2532d60fa8fb5508b47bd8202d3f
MIME type:	text/xml
Signature	RedLineStealer

File name:	REDEngineErrorReporter.exe
File size:	261'280 bytes
SHA256 hash:	b73f55987569aa86346d2077e5ab52a3913111d1925fb309406a6473861e731b
MD5 hash:	22fc9df78f69791199fa8b89db95dc2e
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	CrashReporter.exe
File size:	87'200 bytes
SHA256 hash:	b28197f68758f88c51066abed1e87d14539e0c322e945abd034ca8cc0863ae31
MD5 hash:	d83b49b2fa3773e77fff914762e32b3e
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	ThirdPartyNotices.txt
File size:	1'244 bytes
SHA256 hash:	4aeceeb1237cddcc0db18595cffe553f74c17690ab38b6b1dcbc770aa3c21889
MD5 hash:	ca05840427a0ef64877d4c25a691138f
MIME type:	text/plain
Signature	RedLineStealer

File name:	CrashReporter.resources.dll
File size:	4'608 bytes
SHA256 hash:	cab8f1091f7c6482a1e40b6514d273e4408ef26ebf6ef9dbc902878d8a765c05
MD5 hash:	d55c66a394b8e52d98923ac6e37afc26
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	nvngx_dlss.dll
File size:	14'464'712 bytes
SHA256 hash:	571ea372b70575d8d4728e86e0848f7d1e511a59e82b4014528ee84e660098c6
MD5 hash:	7e5575719ade3b259e4ef3feb262f40c
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	CChromaEditorLibrary64.dll
File size:	302'592 bytes
SHA256 hash:	adfda8389420406892879baac7f257449601bac95b786cc66bba91b558960726
MD5 hash:	e253c563abe0cec80217a37092aa5401
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	d3d12.dll
File size:	1'906'768 bytes
SHA256 hash:	5f98349ac0e3b6d06d214303bf5b1644c8e6a7e1b3d590c6c5650492d32661ef
MD5 hash:	5c40ee95f29dad945fa3b630f103072e
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	oodle_dictionary.bin
File size:	1'809'181 bytes
SHA256 hash:	b150712d48fdf017fe033edd07cadd28a58eb47667564e8cd847ba504202597b
MD5 hash:	9193f16ba682e9c880baad981f88c41c
MIME type:	application/octet-stream
Signature	RedLineStealer

File name:	nvngx_dlssg.dll
File size:	12'932'648 bytes
SHA256 hash:	2d724b21f2aea77e42cd21344ce102bf2e63c81b2ecbb353dd6d96cfff1a2be1
MD5 hash:	4f39303b168462a4f2ecf04fead1a9e8
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	PhysX3Cooking_x64.dll
File size:	652'288 bytes
SHA256 hash:	48329a444413dc0fcc84968c7f4669343f7836cfe8454eff5223b452d4e9d297
MD5 hash:	f55dc176569629dcddf0f9afc8819d88
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	REDEngineErrorReporter.exe-20230131-163730-9972-38420.txt
File size:	31 bytes
SHA256 hash:	ed1ab33aeae69f3dde9ca47f9eeed8cfd1d17b96d029febfa7ebaefe1a601513
MD5 hash:	4ae794aaeecdadef54cf5baae19c9c14
MIME type:	text/plain
Signature	RedLineStealer

File name:	icuin.dll
File size:	2'632'704 bytes
SHA256 hash:	adadc9ebed9cd2d06ff8e3ca9dc305e1e9af415e9d25718c48d2378bb57083d2
MD5 hash:	7c49276c8815272f7710e58702f95d00
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	7za.exe
File size:	1'152'000 bytes
SHA256 hash:	8117e40ee7f824f63373a4f5625bb62749f69159d0c449b3ce2f35aad3b83549
MD5 hash:	e86eff95691b1c0e7e4f3e9cb1ae2e49
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	api-ms-win-downlevel-kernel32-l2-1-0.dll
File size:	6'656 bytes
SHA256 hash:	bf50b9715c9e9acf701d3f340fdabac804f6029ebfa1d12314085218f8882ef0
MD5 hash:	7294c1e3e8b30d0c3cfb768f3fcda0e4
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	LICENSE.txt
File size:	9'894 bytes
SHA256 hash:	1c29e1d87dac757a11cdf169107b95db11c4503436a4ea8bdb33e874a934f8cf
MD5 hash:	92e82d2e88a443449b19f284f037bb55
MIME type:	text/plain
Signature	RedLineStealer

File name:	libcurl.dll
File size:	419'328 bytes
SHA256 hash:	4ec94dc7314c783db46dd3ad9c28a9f8bf10a50b29c4730370b568565fcb46e8
MD5 hash:	2854bcf26534a5e6a4a50214cccee06c
MIME type:	application/x-dosexec
Signature	RedLineStealer

File name:	Evolion.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	1'160'310'736 bytes
SHA256 hash:	6ac88112adb7cf390e8107513f12d542b7a869ed7bb093332b199a8493a550bd
MD5 hash:	2a00299fc5e4519ce5c216855bdb000b
De-pumped file size:	577'024 bytes (Vs. original size of 1'160'310'736 bytes)
De-pumped SHA256 hash:	416ffbf541ec396c711f1553576931c65af849b67158250030f5b94827b3da83
De-pumped MD5 hash:	04af92ffdf13bc3b98ac14a5c6f752fc
MIME type:	application/x-dosexec
Signature	RedLineStealer

Vendor Threat Intelligence

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ni55lnbdropd4yzt5kq6jrsy32xlj2nhcfo54vek5rjpqxzgsm7a._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer spyware

Link:

https://tria.ge/reports/230706-xd3sbsdg73/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Uses the VBS compiler for execution

RedLine

RedLine payload

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	redline_stealer_2 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

rar 6a3bd5b4238b9e3e6333eaa1e4c658deaeb4e9a7115dde548aec52f85f26933e

(this sample)

6ac88112adb7cf390e8107513f12d542b7a869ed7bb093332b199a8493a550bd

Link

https://iamdeadlyz.gitbook.io/malware-research/july-2023/fake-blockchain-games-deliver-redline-stealer-and-realst-stealer-a-new-macos-infostealer-malware

Dropping

SHA256 6ac88112adb7cf390e8107513f12d542b7a869ed7bb093332b199a8493a550bd

Dropping

SHA256 416ffbf541ec396c711f1553576931c65af849b67158250030f5b94827b3da83

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2677926/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample