MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294
SHA3-384 hash: 4d59f4d8cc57ebe945bb7bb61650ad56baf08f79a3a8d208e0de540d0a93137a4ff3755ca40576968fe0f31a84cece72
SHA1 hash: 7d71af83bb75d0ddeef1e0e2bc83b8c8fabd3554
MD5 hash: 899283d7a23c46a44a67901b215e5e6a
humanhash: georgia-helium-beryllium-triple
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:409'088 bytes
First seen:2023-09-19 08:29:56 UTC
Last seen:2023-09-19 10:50:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 36723152dcc89be0d0104bd374001ada (74 x MysticStealer, 4 x RedLineStealer, 1 x Amadey)
ssdeep 6144:ujhjEj2jicP5iOo2T8VrSd/sUAOMclYKobxu8CKobxu8DJ0TqvffFW1Sa:ujhyqiG59ouuc5v3FW1Sa
Threatray 1'012 similar samples on MalwareBazaar
TLSH T131947DB37AB2C0B1C479223748B07B610B2D746ACCA99C9F6790195A5BB41CF43F1B9D
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.169.175.232/autorun.exe

Intelligence

File Origin
# of uploads :
9
# of downloads :
298
Origin country :
US US
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/449614/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.61167.30672.11736.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Creating a file
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/65095c0f33582f234efbaa36/reports/b2c228a6-fe74-478b-8b55-d03f86e6dfb3/overview
Verdict:
Malicious
Labled as:
TrojanS.F23C58EC
Link:
https://www.hybrid-analysis.com/sample/7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35ddc15c-f184-4d20-8df9-eb447a9bc3de
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1310633
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294/
Threat name:
Win32.Spyware.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2023-09-19 08:30:09 UTC
File Type:
PE (Exe)
AV detection:
15 of 23 (65.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=onkwk3ehu7qlzll2efxgl7qglfdoblti444hpxlfd4gvwsddokka._file
Verdict:
malicious
Similar samples:
1b13df7970dd431fb6ffded3d14c2d2874d4296f2be5e802b119e2dbf128dff0
RedLineStealer
714fb77468c06eabe914f400ebda1eb96f192352dcad66c87fbbeb57368d4e02
RedLineStealer
7b22e6cc31710809bbb88f27afa15ad45784dd0ccd3da27be9b6ca3b039a15ce
RedLineStealer
845321e0072b6a37c502b6f5992d8e750ac254c3b09c9e55874722fae5ba87d4
RedLineStealer
8df6ff949de778a20deb98bd90e21d9e9449045b73f75cd62c051957997882bb
RedLineStealer
9871bad0fe503c40a0eab3cf108ac0a92b390af6ff5022a1760d388719642672
RedLineStealer
9f78f23917333e4e4ee095e36f159d24d29117296c458b748831d4c0ede6b938
RedLineStealer
bb1b75ca2b1cf87a535caf84537badae8ea32f9565c45a8eb955002d708cf258
RedLineStealer
c1d088856f128aa9dbd120f2a727fbb33ae1567caf85d612426345d5e34545eb
RedLineStealer
d2f6db105fe997f60739a7b253dc4d863d35a41105c36bfd16a7a26a5a37b808
RedLineStealer
+ 1'002 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:smokiez infostealer spyware
Link:
https://tria.ge/reports/230919-kd568shh75/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
Malware Config
C2 Extraction:
194.169.175.232:45450
Unpacked files
SH256 hash:
06ccfcf139d88fff6ec60c4b214002948d83ffabe9ef129a287d470c9113cc89
MD5 hash:
11df5a1b994abac487cbb67c93da9dcb
SHA1 hash:
bb037f77d8c894f57f5e95300de2d5e259ecbcd1
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/07d3f017-313b-44bc-b58b-0911f07cf6fe/
Parent samples :
bbac59c3c6a41bfc78a1c6704908d45b0be839280cb7ad41047f870eb298d785
f6ab311f90ea211f69048bb4a809f8adb4a6e02e9d143ef0bd29c8eaad0617bb
0af6821bfe730759d049249d66b09f8b0ba6cae5c5d774ac229b4811b14f7e89
52b4d5ccbf54f79bc94b9779d549e5710a231bcef1cc76b611c21f4e9ad756d0
8a3604b987de66e8a95a64aa7d0f6512b6f8e84d33bba9d5ae712f35212a6cd7
a3cf3e8a2a44ac90b160dc908784b66611258f34a0d00f84c9c80eadd1cf155c
ec53e2555605c5424630d394f6b11677be607c4060ea5772b4afd9ed4f0f94c7
46708920ef342e349ea2368a3a4030da4ea2f441c1415581e9ff0576deb65706
4215352824a635ba671af9c6e265b99ea2a6aca8af16351ec9befa9c6fc5df0f
648f173d9b3a237a978db01181f717f6dbf04720db6f9ff0b3844c0b239e9b85
ea63340c1c1914c476b780cf79e8189c9aa1b38ff6b406f66a3fc630799cb911
9871bad0fe503c40a0eab3cf108ac0a92b390af6ff5022a1760d388719642672
7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294
e90f03124f4c584d8e5a7d8bdf7e99e0255906df3463bda1b04aaa77a8f65aff
70f5ad3b8570e476355717bce4974d7c4dadf850d6ffc6dc2a095be285f7fc90
700985f7c1ac041e2ba3762046f248e88a1d6d96ee043ff45fe83fdc8b5f01bb
a329414a50b9c2444f4ae14baa47b333dd96b1ece4fb6033cc462d2efd2cbfe2
9d717f55876b260cb9dfd43b9c3326ede81d078440b08c06099f64de59b4afe3
63cebbe380cf99272e0d8eb7a3ed9b84633a3eaa048484ab83019b570e711383
4ceda80398f8caee44949b1d3bc77029da005109458a17febf41a0c56bcc8ab1
4719ed476debe539f2920aebc93035bbbeb7897f8692bbf2115b8639dde710a4
4a6233c912ff669059c5b9b3ab52e5d603033b3bd4f10f4eb50622d37c164242
d7a18a9568dbbd0f8d355eff436d3a1ecf48c2784f6b3c692cbcd7829768908d
83af37abbff9157d10d89b307868a2df6c57c22da80bcfa1dc221cb403993890
SH256 hash:
7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294
MD5 hash:
899283d7a23c46a44a67901b215e5e6a
SHA1 hash:
7d71af83bb75d0ddeef1e0e2bc83b8c8fabd3554
Link:
https://www.unpac.me/results/07d3f017-313b-44bc-b58b-0911f07cf6fe/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7355656c87a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7355656c87a7e0bcad7a216e65fe065946e0ae68e73877dd651f0d5b48637294

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/449614/
  
URLhaus
https://urlhaus.abuse.ch/url/2706937/

Comments