MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195
SHA3-384 hash:	0d7921873bdee809abeb06913018d7eb4528b5ecff3dc3cd1ae68769371a2ea0de842953b46532940fe0462cb48decd5
SHA1 hash:	8bee1f7b5e93f1223ec7618eb269c9bb6c03b81f
MD5 hash:	ff3bc60de16cecf4ad172ea0c8f18c5e
humanhash:	nebraska-uranus-timing-texas
File name:	SecuriteInfo.com.Variant.Zusy.465956.15917.18418
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'310'720 bytes
First seen:	2023-05-02 20:32:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a474be77234ae202002ad60047ac23ca (2 x RedLineStealer, 1 x DCRat)
ssdeep	12288:iry5lGBmeRAqyugQg+IxZWesiXV2bgry:i64Rhpgj+IjWCXIbO
Threatray	1 similar samples on MalwareBazaar
TLSH	T1EA55E101B5D1C472D47221320AE1EB765E3EB9700BA199EF6B941F7E4F303C2977296A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	SecuriteInfoCom
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

311

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

SecuriteInfo.com.Variant.Zusy.465956.15917.18418

Verdict:

Malicious activity

Analysis date:

2023-05-02 20:33:45 UTC

Tags:

redline

Link:

https://app.any.run/tasks/c838f0ed-0f57-4ea1-a5d3-53de62bfc922

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/386160/

Detection(s):

SecuriteInfo.com.Variant.Zusy.465956.15917.18418.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Forced shutdown of a system process

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/6451737fedfde86c79816076/reports/d242630f-c5ba-4902-84b8-2763c5004a94/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9ea110ce-bbd6-4fbc-b919-6126b1ec5fc0

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1224986

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-05-02 19:48:07 UTC

File Type:

PE (Exe)

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=obxdu7bpuimfvm6ywoab24hpglm2rnpnyke6izqw3dqz7ehjqgkq._file

Verdict:

malicious

RedLineStealer

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer spyware

Link:

https://tria.ge/reports/230502-zbt4hsec3s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

Malware Config

C2 Extraction:

45.15.157.67:37535

Unpacked files

SH256 hash:

51b048b8a41570e2d85e32489d3697bd373eb2eb98ab968549a0e2b0289c3531

MD5 hash:

471b2c287564e281c5fdf2f7d1e3ec3e

SHA1 hash:

0a94f3b55d228a4d70ba001b05e96ba3b69486c5

Link:

https://www.unpac.me/results/3aa05d51-da6c-4f7e-a1bd-c24677376928/

SH256 hash:

706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195

MD5 hash:

ff3bc60de16cecf4ad172ea0c8f18c5e

SHA1 hash:

8bee1f7b5e93f1223ec7618eb269c9bb6c03b81f

Link:

https://www.unpac.me/results/3aa05d51-da6c-4f7e-a1bd-c24677376928/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/706e3a7c2fa2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/706e3a7c2fa2185ab3d8b3801d70ef32d9a8b5edc289e46616d8e19f90e98195

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.