MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71dde2fc30c31c903066ada95dd124f8581f6b2d066ed4087bf6e936a9f867ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 8 File information Comments 1

SHA256 hash:	71dde2fc30c31c903066ada95dd124f8581f6b2d066ed4087bf6e936a9f867ed
SHA3-384 hash:	dfee7d92a3bb7045cc8ebcccd348d1f62cae5326c37e9a7245e40e8e72a090a6da2837d60b8b6591239a4586c137a267
SHA1 hash:	e1ed4ecae5103dab6cfef5301742dac80531cc89
MD5 hash:	498a0133e33697979526f561d25db331
humanhash:	sodium-alanine-quebec-michigan
File name:	498a0133e33697979526f561d25db331
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	3'113'039 bytes
First seen:	2022-03-31 08:58:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep	49152:O8WjaQ+97hqiWuLHhuyjAUNScH5tZkVGi7TA0wWfyLb+ndmw3bB2AHUBGa5Kd2Pd:O8WjutcXuFuAABcHZ+GiSLAT39T0BedC
TLSH	T156E533A78949967ACEEFD0352B398C28B7CDD797068308A296505D3B1F41D2FFB74980
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

200

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/259971/

Detection(s):

SecuriteInfo.com.Variant.Zusy.400650.27538.10397.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

Сreating synchronization primitives

Sending an HTTP POST request

Sending a custom TCP request

Creating a file

Query of malicious DNS domain

Sending a TCP request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62456d5aa19c649412b1dd85/reports/24793073-cab0-497d-b9c6-dc231b64f6b5/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0537a068-8c10-43e5-b51a-540ca9b68d90

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/968124

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/71dde2fc30c31c903066ada95dd124f8581f6b2d066ed4087bf6e936a9f867ed/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2022-03-31 01:54:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:cheat evasion infostealer themida trojan

Link:

https://tria.ge/reports/220331-kxqkwsddfq/

Behaviour

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Checks BIOS information in registry

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

RedLine

RedLine Payload

Malware Config

C2 Extraction:

84.38.132.100:29934

Unpacked files

SH256 hash:

71dde2fc30c31c903066ada95dd124f8581f6b2d066ed4087bf6e936a9f867ed

MD5 hash:

498a0133e33697979526f561d25db331

SHA1 hash:

e1ed4ecae5103dab6cfef5301742dac80531cc89

Link:

https://www.unpac.me/results/b6cb093d-75c7-4807-a475-de0bff9159ed/

Malware family:

RedLine

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/71dde2fc30c3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/71dde2fc30c31c903066ada95dd124f8581f6b2d066ed4087bf6e936a9f867ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	RedLine_a Create hunting rule
Author:	@bartblaze
Description:	Identifies RedLine stealer.

Rule name:	redline_new_bin Create hunting rule
Author:	James_inthe_box
Description:	Redline stealer
Reference:	https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8

Rule name:	redline_stealer Create hunting rule
Author:	jeFF0Falltrades
Description:	This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)