MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3
SHA3-384 hash: ed0f68cef12309b444376873a0fd4a78da1b81520461d10c6bf286b4a828dd0b1f0b40d09c8c25f5c9d151695e383a09
SHA1 hash: da2d4d7cc36925e9d1617ceb8158eab7fe3869d1
MD5 hash: a32e1510eaf70c772b81fc4e9f4c46f3
humanhash: black-mississippi-angel-twenty
File name:a32e1510eaf70c772b81fc4e9f4c46f3
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'117'307 bytes
First seen:2023-07-31 11:57:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:c2G/nvxW3W+XNEtL8GiXTBhq7rHFQSHuCGt7p5rcre:cbA33Y4kQS9GtPcre
Threatray 67 similar samples on MalwareBazaar
TLSH T19335DF1BFC026F65C331D87B0A8E89203CBA127B5F929F1772656997AF909C6F03055B
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9269cccccccc6996 (1 x AZORult, 1 x RedLineStealer, 1 x QuasarRAT)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
a32e1510eaf70c772b81fc4e9f4c46f3
Verdict:
Malicious activity
Analysis date:
2023-07-31 11:59:52 UTC
Tags:
evasion redline rat trojan stealer
Link:
https://app.any.run/tasks/2426352c-4975-4d5f-a375-c8a7bbbcf83e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/439411/
Detection(s):
SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Running batch commands
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
DNS request
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd fingerprint greyware lolbin lolbin netsh nslookup overlay packed packed powershell replace setupapi shdocvw shell32 wscript
Link:
https://www.filescan.io/uploads/64c7a1cae64bd705397ef688/reports/509a337a-fb52-4ae1-8340-9be5fa869e21/overview
Verdict:
Malicious
Labled as:
Trojan.Rasftuby.Generic
Link:
https://www.hybrid-analysis.com/sample/74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e0f4ab57-0346-45da-be13-f2728908fdba
Result
Threat name:
DarkTortilla, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1283137
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suspicious powershell command line found
Uses nslookup.exe to query domains
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected DarkTortilla Crypter
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1283137 Sample: vMSfDOO3WJ.exe Startdate: 31/07/2023 Architecture: WINDOWS Score: 100 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Antivirus detection for URL or domain 2->62 64 7 other signatures 2->64 10 vMSfDOO3WJ.exe 14 2->10         started        process3 file4 42 C:\Users\user\AppData\Local\Temp\7z.exe, PE32 10->42 dropped 44 C:\Users\user\AppData\Local\Temp\7z.dll, PE32 10->44 dropped 46 C:\Users\user\AppData\Local\Temp\C3.bat, DOS 10->46 dropped 13 cmd.exe 3 2 10->13         started        process5 signatures6 84 Suspicious powershell command line found 13->84 86 Wscript starts Powershell (via cmd or directly) 13->86 88 Uses nslookup.exe to query domains 13->88 90 Adds a directory exclusion to Windows Defender 13->90 16 wscript.exe 1 13->16         started        19 conhost.exe 13->19         started        process7 signatures8 56 Wscript starts Powershell (via cmd or directly) 16->56 21 cmd.exe 2 16->21         started        process9 signatures10 66 Suspicious powershell command line found 21->66 68 Wscript starts Powershell (via cmd or directly) 21->68 70 Adds a directory exclusion to Windows Defender 21->70 24 C3.exe 2 21->24         started        27 cmd.exe 1 21->27         started        29 7z.exe 3 21->29         started        32 6 other processes 21->32 process11 file12 74 Antivirus detection for dropped file 24->74 76 Multi AV Scanner detection for dropped file 24->76 78 Writes to foreign memory regions 24->78 82 2 other signatures 24->82 34 InstallUtil.exe 24->34         started        80 Uses nslookup.exe to query domains 27->80 36 nslookup.exe 1 27->36         started        48 C:\Users\user\AppData\Local\Temp\C3.exe, PE32 29->48 dropped 40 WMIC.exe 1 32->40         started        signatures13 process14 dnsIp15 50 222.222.67.208.in-addr.arpa 36->50 52 resolver1.opendns.com 36->52 54 myip.opendns.com 36->54 72 May check the online IP address of the machine 36->72 signatures16
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Suspicious
First seen:
2023-07-31 11:58:05 UTC
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ot2ggldqc554ko6zkh5dpqifg6lac63lri6w2wfcqh5locxx2orq._file
Verdict:
malicious
Similar samples:
2054c3ef530c59f98144021367033dabf8e2201c11ca12d270fb28e36754c22f
RedLineStealer
6da210965cd769856bbcb8bb501abf25c832f0f6a70e73240436629ce6362fa9
RedLineStealer
8e16230a9d5336fb1d6c6278b45e3b653aa2f6cd060742f28cd68d6a5117a396
RedLineStealer
a05b12806135be357756f9bfed4e77836f44919a56351a2aa127ae8eecf54c1c
RedLineStealer
b8338eda2c7390860da3bd4a37104b409235131406d9b4d30a78b5d4189cf317
RedLineStealer
d7f94c05f6d679ea0df97e773ee754166ecee640bd2b93e2b533bab9568cae84
RedLineStealer
ee940a7aa97eb3393467100d8e2a15887a794fb6f309b36486f8863d748ea22a
RedLineStealer
+ 57 additional samples on MalwareBazaar
Result
Malware family:
sectoprat
Create hunting rule
Score:
  10/10
Tags:
family:redline family:sectoprat botnet:stp evasion infostealer rat trojan upx
Link:
https://tria.ge/reports/230731-n48ltsga6t/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
UPX packed file
Unexpected DNS network traffic destination
Modifies Windows Firewall
RedLine
RedLine payload
SectopRAT
SectopRAT payload
Malware Config
C2 Extraction:
94.131.105.161:1337
Unpacked files
SH256 hash:
74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3
MD5 hash:
a32e1510eaf70c772b81fc4e9f4c46f3
SHA1 hash:
da2d4d7cc36925e9d1617ceb8158eab7fe3869d1
Detections:
win_xorist_auto
Create hunting rule
Link:
https://www.unpac.me/results/b231043b-ea77-40bd-9f81-5a1bf007317f/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/74f4632c7017/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:win_xorist_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.xorist.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 74f4632c70177bc53bd951fa37c1053796017b6b8a3d6d58a281fab70af7d3a3

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2693668/
Cape
Cape
https://www.capesandbox.com/analysis/439411/

Comments


Avatar
zbet commented on 2023-07-31 11:57:10 UTC

url : hxxp://5.42.92.67/lend/C3VB.exe