MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7607c9b4b1a6625acab3d15d65ab98dbc5dfa5a96c38cc83837354364ca50ce4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments

SHA256 hash:	7607c9b4b1a6625acab3d15d65ab98dbc5dfa5a96c38cc83837354364ca50ce4
SHA3-384 hash:	7452c11576c85a40113bc96a35c91eb9712ea69551eb370be97633d19b920433596c72a6423ff6482d80c54109b92483
SHA1 hash:	44ec2fa73a3e5ad6de01605815efedd324d2efca
MD5 hash:	6fe9416809f5da05b48bf86e1375e7be
humanhash:	cat-leopard-august-moon
File name:	7607c9b4b1a6625acab3d15d65ab98dbc5dfa5a96c38c.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	377'856 bytes
First seen:	2022-04-14 20:51:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fa2c1c2025401d8e07526c236f7249ea (2 x RedLineStealer)
ssdeep	6144:VEFzZ2wH8UhgDwjC89m7A/vT6kNJ9kWqF40VT0JkqU/vc8z+HVd71:2t4wcUODwF9aA/t79kPF42TqavHzi771
TLSH	T1B784C081B6A0D03DF1B742F4B97A83ACB92E7DA15B2454CF22D626DE16346E0DC7530B
TrID	40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 17.0% (.SCR) Windows screen saver (13101/52/3) 13.6% (.EXE) Win64 Executable (generic) (10523/12/4) 8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	b2dacaaecee6baa6 (23 x RedLineStealer, 22 x Stop, 13 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
185.215.113.70:12189

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.215.113.70:12189	https://threatfox.abuse.ch/ioc/519949/

Intelligence

File Origin

# of uploads :

# of downloads :

382

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

59ed82c199b898164620d6380288e2b6e90baf36b4c0e.exe

Verdict:

Malicious activity

Analysis date:

2022-04-14 20:17:42 UTC

Tags:

evasion opendir loader trojan rat redline

Link:

https://app.any.run/tasks/1ebccc53-6db8-4481-91bd-f5a781b74e80

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/263866/

Detection(s):

SecuriteInfo.com.Variant.Zusy.419451.19895.29755.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Sending a TCP request to an infection source

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/13923/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed zusy

Link:

https://www.filescan.io/uploads/6258898dffe27d5119d223ae/reports/3cd9e0ff-350e-44cc-8cea-4252f61a1b5f/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/03317a71-7965-47c5-b56c-a36ae9f3d2f2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/977174

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7607c9b4b1a6625acab3d15d65ab98dbc5dfa5a96c38cc83837354364ca50ce4/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-04-14 20:36:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oyd4tnfruzrfvsvt2fowlk4y3pc57jnjnq4mza4donkdmtffbtsa._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:metastealer family:redline botnet:mix15.04 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220414-znp1bsghf7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Meta Stealer Stealer

RedLine

Malware Config

C2 Extraction:

185.215.113.70:12189

Unpacked files

SH256 hash:

462ea456d91f5c888121b3aebb4d54fe87ec30b0bbb6a8f544f2921115fe960c

MD5 hash:

d624da2230c7a07128053a4002cf5176

SHA1 hash:

b2b8e3a5f54a2a2aba187f962cda75be51bac8eb

Link:

https://www.unpac.me/results/b4978cf1-f868-4d93-920f-ea53aaa4a539/

SH256 hash:

47d97f8d535cfbb959e3613b49134c30a3d328d6019c9b7cb9b49663d337c8a7

MD5 hash:

607ded8be9310d2f48ca63591158f4b6

SHA1 hash:

ad38a50b8fab670353fbdf1a105877ce020245bf

Link:

https://www.unpac.me/results/b4978cf1-f868-4d93-920f-ea53aaa4a539/

SH256 hash:

81f05319244138a17debf658d2d4adf0eab9f60d4e12a6b88cd328f7af88ae71

MD5 hash:

a3f0d7a23318885b5910a31b596f1a33

SHA1 hash:

2c46a2334695ecf41a5c7c430a619b7c62112716

Link:

https://www.unpac.me/results/b4978cf1-f868-4d93-920f-ea53aaa4a539/

SH256 hash:

7607c9b4b1a6625acab3d15d65ab98dbc5dfa5a96c38cc83837354364ca50ce4

MD5 hash:

6fe9416809f5da05b48bf86e1375e7be

SHA1 hash:

44ec2fa73a3e5ad6de01605815efedd324d2efca

Link:

https://www.unpac.me/results/b4978cf1-f868-4d93-920f-ea53aaa4a539/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7607c9b4b1a6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7607c9b4b1a6625acab3d15d65ab98dbc5dfa5a96c38cc83837354364ca50ce4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.