MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 3 File information Comments

SHA256 hash:	71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6
SHA3-384 hash:	f607895b34803da9880b948ae9a24780ae3afb9ddbd155a0a00f9a43bcf4523fb50ae767dbc40ac57768977b3ec97730
SHA1 hash:	03c80ccbe0c2b6c60102e4bc274b6342a1a5280b
MD5 hash:	8b2c22060d17a78d5120cdb6373565fc
humanhash:	magazine-october-red-india
File name:	8b2c22060d17a78d5120cdb6373565fc.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	377'344 bytes
First seen:	2023-07-24 08:30:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8d73c631f2f5f137cb9690031965306c (2 x RedLineStealer)
ssdeep	6144:Lz9QLNE6dzvyx0JEE3C2VmaISi/idxmdQ11:3G59dzvyx0J73C2E//2GQ
Threatray	183 similar samples on MalwareBazaar
TLSH	T15584295392B33D95E927DB729E1EC3F8761EF2508F4977AA12199B3B04B10B3D263610
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	000808080a020400 (2 x PrivateLoader, 1 x RedLineStealer, 1 x RiseProStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
149.202.8.114:26642

Intelligence

File Origin

# of uploads :

# of downloads :

273

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

8b2c22060d17a78d5120cdb6373565fc.exe

Verdict:

Malicious activity

Analysis date:

2023-07-24 08:32:42 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/c1c4ff2f-5d4b-4d39-ab2e-3a6e8ceb28bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/430603/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e9ee5928-0670-4911-8a3d-1fad723f19ea

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1278136

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redline

Link:

https://mwdb.cert.pl/sample/71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-07-24 08:31:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=oguk26nolr47s2bveb67dkulofyqmazorlkpyqcip2l4xgjbc6ta._file

Verdict:

malicious

RedLineStealer

0c5d1c2c1f5bcb910d25419e87349bce28055b67de3ef6bd1e511a6b17290fce

RedLineStealer

572e60bad91adcc0711b6c93408bc73812d05a7485b0f2a5125f4e3af19dcba0

RedLineStealer

6b7ee0a57c1cfcfadfc414c782a371f8e3a29c75446a45c33b7a31e92e4ac802

RedLineStealer

75f9db664373b1e957799e65139d1468c7cc7f39ce171c100b875d886cda0690

RedLineStealer

7ed395afebf774d7e1e0ce47b88445afc2a8b9811c94553f6923ba4496ce9962

RedLineStealer

83172a05a1bf277edad661d291cf26ed197ff9917a878e00d980e6748e3541a7

RedLineStealer

8359a347a41ef75b7a1591d2bd81372d24e25aab079e08ab7185bdbb0948955c

RedLineStealer

8a9e291a57a70f07a7d3b0aee7f05b8268a5af104b1bbafa571d8d662fcd66b0

RedLineStealer

+ 173 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:logsdiller cloud (tg: @logsdillabot) discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230724-keqg6sbh82/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Malware Config

C2 Extraction:

149.202.8.114:26642

Unpacked files

SH256 hash:

1161f2aaede4428d7c5ad55c68d14531c7459a2a946e9b946553027db4087b9e

MD5 hash:

5b9e910f14c9664c591d075ccfdda0c3

SHA1 hash:

dbbbe03ec1f8b19d8ae3c39912c7cc07d35c0fe3

Detections:

redline

Link:

https://www.unpac.me/results/39fb1226-1a01-4910-88dc-507131987212/

Parent samples :

76ae20cea89aac265c5403e1cd0e7baab8f205eaed7a48f199f86b4009d57df5
42f569feb9d6fc7561953999288ab6241dd8825c1a9ba2e7f268d5f47c612da8
de29dab2172b40d8d48cdc9eb25fde26061d967233458f5868177b50c9e65f4b
07ad5d7c0500cbdeb837ad3e40946a6bcfca31f2e68ef316106513f40e8b55cd
01fff06ce60d4c145adad197c4de54435d775e15cefb00ad0329842dafd241ef
71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6
d729259da24021bd2ae9efbf7a9951febfc2ce0ffda9222c27c0e28c59198713
e1d8649ed45d3487ed75f3b56fc06e63a409162c528eaf378bff7c294b7e7bfb

SH256 hash:

cbb2b3d88f8407ad3533d49d83ee97450a946073cbf9eface7bf8a0aba6a2977

MD5 hash:

1170152a8e1dc3e4b9c38d8146362e81

SHA1 hash:

d1a14beb19d4242e9237c59d5b5d85a3c2c70aa1

Detections:

redline

Link:

https://www.unpac.me/results/39fb1226-1a01-4910-88dc-507131987212/

Parent samples :

SH256 hash:

ae08b6ce7cdd04919c987c48a8e1fd11316e15f8071c063e8060251ba49e092e

MD5 hash:

b9ac7ada76639bf533b86fc0ae86597c

SHA1 hash:

74ce4a5df518a85c44d5d51fd3213fd6da36940d

Link:

https://www.unpac.me/results/39fb1226-1a01-4910-88dc-507131987212/

SH256 hash:

ef904719bce27fd4ef1e3221cb658a1ba93f7fafccc16d6e0ffb00a1bfb399e9

MD5 hash:

3c81ebdb4f2dc1f98485343dfeaedce5

SHA1 hash:

0ce97f6e8d3cdac8b68329d57b4d16873d6ed167

Link:

https://www.unpac.me/results/39fb1226-1a01-4910-88dc-507131987212/

SH256 hash:

71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6

MD5 hash:

8b2c22060d17a78d5120cdb6373565fc

SHA1 hash:

03c80ccbe0c2b6c60102e4bc274b6342a1a5280b

Link:

https://www.unpac.me/results/39fb1226-1a01-4910-88dc-507131987212/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/71a8ad79ae5c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/71a8ad79ae5c79f96835207df1aa8b717106032e8ad4fc40487e97cb992117a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/