MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e
SHA3-384 hash:	f9853bff0abeb0fdc25f7333c4491e8092b603a1cf5badae8cef6a65d5739a719280952f067fdbaa9f3cb2c7e3fbe553
SHA1 hash:	ca69309042f9bdafd2b89fc2946760e1e6c76f9c
MD5 hash:	e494a5ad707a5770becf3eec98e5d030
humanhash:	early-neptune-comet-early
File name:	e494a5ad707a5770becf3eec98e5d030.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	399'872 bytes
First seen:	2021-10-03 12:29:19 UTC
Last seen:	2021-10-03 14:14:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e1dc734f9d3fd8ffe237c21274508ba5 (4 x RedLineStealer, 2 x RaccoonStealer, 2 x ArkeiStealer)
ssdeep	6144:kqzgRNxLnc0yfaN9VdsXX+7XCNd02qQUEEFSpL6MCOhxxFeTr/ekI:vzaxLc0yssXXiyNd3yEHL6+zxF6L
Threatray	7'050 similar samples on MalwareBazaar
TLSH	T18184C0097290CFF2D6B506B1AB16F7E08A2DF8695C97D24F3794362EBE3D3918612341
File icon (PE):
dhash icon	fcfc94d4d4d4d8c8 (6 x RedLineStealer, 1 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e494a5ad707a5770becf3eec98e5d030.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-03 12:41:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/94e6c7f7-8737-419a-aca0-7501cd5118fc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/194339/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.30971.23514.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2c0643d2-8ac0-42dd-80ec-9220014a912b

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/863420

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-10-03 12:30:18 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=opkwta3xvusiijlmiu3bmsmjorikyqxfebcv4s5n2iczbktspj7a._file

Verdict:

malicious

RedLineStealer

0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde

RedLineStealer

24bb15d093025a935e0de62e850056aea484990c713517cd53de6696b5e9db52

RedLineStealer

360099a2671501102cf321e820d7d80f997effcea91ff43c7251ba2313af5c94

RedLineStealer

3f8b10edee659fb77181d28955a822548a0f3e95dc14a35170bcf47f126dde6a

RedLineStealer

4ff435cfdd9e9e8eabe0b024a18dedab448ecb924db0eda41bbe7b2ab104ce10

RedLineStealer

719838a1192ae6b53966159da56635e7a05754eb017f2538ca3f82c580543280

RedLineStealer

7f5a55bdc72e1235c33759b32d8bd5f92d837ddf6f60a69339a246fb724cbb72

RedLineStealer

9f322df416d8c350f577677c1654efde29b5bbfc09e2510403953d1af7e37875

RedLineStealer

+ 7'040 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:pub infostealer

Link:

https://tria.ge/reports/211003-ppgp8sfdc7/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

7de1f501c6f4edfbb3e61dda5d445b4482235420e19cd3e193ae3be26d374367

MD5 hash:

858ebd87027f4c3adcb5e2c59ec5161c

SHA1 hash:

f758ceef9690fb7430c910fcffd71c0cdb456834

Link:

https://www.unpac.me/results/138f3d8c-cf58-4896-bc47-8f2fed57430e/

SH256 hash:

541526a7b80a64b50c770517545d25c0515a146c3ddc5600a65d91cfdaf5e3a0

MD5 hash:

d964fece1f6eade1b3b0ab1ca479d7e1

SHA1 hash:

cf6948b22255272da7d81e38a936ee90b95c17ee

Link:

https://www.unpac.me/results/138f3d8c-cf58-4896-bc47-8f2fed57430e/

SH256 hash:

4e04bba712969aa15782d796bd66233e30de2ceb2fd6f23f8ec88b64b4857636

MD5 hash:

26e6a498e6fdb35574c6a6e51e0b7d1c

SHA1 hash:

394bd2b1362a1fe2fb96cc69971fa08c43bcbf14

Link:

https://www.unpac.me/results/138f3d8c-cf58-4896-bc47-8f2fed57430e/

SH256 hash:

73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e

MD5 hash:

e494a5ad707a5770becf3eec98e5d030

SHA1 hash:

ca69309042f9bdafd2b89fc2946760e1e6c76f9c

Link:

https://www.unpac.me/results/138f3d8c-cf58-4896-bc47-8f2fed57430e/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/73d5698377ad/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.