MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d5c2e98d03945bea2abd376e3738a097be7747d63762585f2e9f219b27518e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d5c2e98d03945bea2abd376e3738a097be7747d63762585f2e9f219b27518e4
SHA3-384 hash: b8f669d26538037a282c3cf29d51454a1931a2343cb1977bb156034e04b3c7e7915f9e626c779aaad47e5ffb0c46acb4
SHA1 hash: 57123afa9126bdfbc60f200f509cf84cd5def114
MD5 hash: 198583e857cb9c44fe42cb7bddb214fe
humanhash: muppet-salami-cardinal-snake
File name:198583e857cb9c44fe42cb7bddb214fe.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:358'400 bytes
First seen:2021-07-12 09:06:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ca800e5917b37d4675d52303cb1287e (1 x TeamBot, 1 x DarkVNC, 1 x CryptBot)
ssdeep 6144:pOoPayHH3d8S2Au6XM0/SW1r8IZ4EBMhNPv9lRqGMC9389lpR:oQH3d7u6806W5sPlu8ml
Threatray 3'086 similar samples on MalwareBazaar
TLSH T1F4749D206AA0C035E1B702F5597993A8A83EBDB19F2450CBF2957AEF26346D49CF0753
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
198583e857cb9c44fe42cb7bddb214fe.exe
Verdict:
Malicious activity
Analysis date:
2021-07-12 09:23:44 UTC
Tags:
trojan rat redline evasion stealer
Link:
https://app.any.run/tasks/c58fec97-c07e-4cea-874d-54abea75dad1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171017/
Detection(s):
Win.Trojan.Generic-9877459-0
Create hunting rule

Win.Malware.Generic-9877626-0
Create hunting rule

Win.Dropper.Mokes-9877659-0
Create hunting rule

Win.Malware.Filerepmalware-9877678-0
Create hunting rule

Win.Malware.Generic-9877689-0
Create hunting rule

Win.Malware.Filerepmalware-9877699-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b42f078-6406-45df-b507-89ad770ba358
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814657
Signature
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d5c2e98d03945bea2abd376e3738a097be7747d63762585f2e9f219b27518e4/
Threat name:
Win32.Trojan.Bsymem
Create hunting rule
Status:
Malicious
First seen:
2021-07-10 09:07:52 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvoc5ggqhfc35ivl2n3og44kbf56o5d5mn3clbps5hzbtmtvddsa._file
Verdict:
malicious
Similar samples:
1467dbcc4b504ab94baaa6bf9dbb59dbddc3ea61a86452b61760cf6f50417364
RedLineStealer
3ef2031bfa11d5d3185989e60d8ff3568231c78628ff6bb851ae135d222a88a1
RedLineStealer
4dee972756364c4a670b31004c506161750027588c111bb0f1b499acf91ff657
RedLineStealer
56f683b812bfe9dd8a694b34cef3c8759d96a26bddc05b77dfe757494add4a39
RedLineStealer
5b1d5e7cbca5156e7ff4a39d2bd55cc6d1b3286ddac9951fd2c075e1acf3b0c7
RedLineStealer
7525f2c1ccec025adb8f773ab10ecd9cee7bacec9949a7415ad239cec969bfb8
RedLineStealer
7f26cbf3b8402f8971b26019089ec612ea4a50fe74b0afdfcde4b08062c99a03
RedLineStealer
f4b5eac00cd2439b6954c030b91702e2ebefe39e5ed5035225c6460f46eaeeba
RedLineStealer
+ 3'076 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:pudt discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210712-mksema8fx6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
176.111.174.254:56328
Unpacked files
SH256 hash:
d3a86e8c7dfc6da4450f1a19e214637dc87e4bf9e0ad30034803ab80cace095c
MD5 hash:
cb5fc5dd3ba9fdd7af4b8eecf33f77d5
SHA1 hash:
d2bf6ecc946301c58381a88bf12d74204314b7e8
Link:
https://www.unpac.me/results/1f5c4c4b-f49b-4cf7-8a96-b9cb13c2b256/
SH256 hash:
a3774922e16ff1224a3e509b6fffc7c1dabe5a9a680539608b78839e481d7f1e
MD5 hash:
651e96a0d52076aa5ed2d82739b5c9b1
SHA1 hash:
b1ccd75ad0feed1d11deecb72ef0abac5e3ecf09
Link:
https://www.unpac.me/results/1f5c4c4b-f49b-4cf7-8a96-b9cb13c2b256/
SH256 hash:
e13e35685114980f612af2304d7916557b03dc43609ada58de42bfa1bd5929d1
MD5 hash:
d73b577cdc3854b7ba4b09f17a84e1db
SHA1 hash:
0b60823181914658cc07e8629fc9b5ddfcdf1fee
Link:
https://www.unpac.me/results/1f5c4c4b-f49b-4cf7-8a96-b9cb13c2b256/
SH256 hash:
6d5c2e98d03945bea2abd376e3738a097be7747d63762585f2e9f219b27518e4
MD5 hash:
198583e857cb9c44fe42cb7bddb214fe
SHA1 hash:
57123afa9126bdfbc60f200f509cf84cd5def114
Link:
https://www.unpac.me/results/1f5c4c4b-f49b-4cf7-8a96-b9cb13c2b256/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d5c2e98d03945bea2abd376e3738a097be7747d63762585f2e9f219b27518e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 6d5c2e98d03945bea2abd376e3738a097be7747d63762585f2e9f219b27518e4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1394014/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1393122/
Cape
Cape
https://www.capesandbox.com/analysis/171017/

Comments