MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89
SHA3-384 hash:	15cf63356c9e6a31aa6ecd41cff43ad7083388cc7675c450fbf7cef1d43d9a871b804e489bd742af6b43a4bb1e758f08
SHA1 hash:	a796a9ab04b57c66b4261cf5cb2954d739da4a96
MD5 hash:	f9598543bf08aca31ef98a86d526d440
humanhash:	delta-sad-magnesium-nebraska
File name:	SecuriteInfo.com.Win32.PWSX-gen.9924.15944
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	325'120 bytes
First seen:	2022-11-25 01:30:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2d129e25454562ff3cc878ef0dbc787a (5 x Smoke Loader, 3 x RedLineStealer, 1 x TeamBot)
ssdeep	6144:Nrs1LvN5xxa7ocDgKZ7XYJt0jPd/WUzBolqsAHY2F5PtxvW:Nrs1J5xxaDUKZyQvqqsAHNxtxu
TLSH	T13864F2327A90C072C5AB05705934EB94AB7DF5311A799B4B77B802AE2FB07C0763734A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	2dac1370319b9b91 (22 x Smoke Loader, 20 x RedLineStealer, 18 x Amadey)
Reporter	SecuriteInfoCom
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

437

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

SecuriteInfo.com.Win32.PWSX-gen.9924.15944

Verdict:

Malicious activity

Analysis date:

2022-11-25 01:32:53 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/17548d13-4456-4936-b8ee-a5e1e62176ca

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/338241/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.9924.15944.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/63801ad9559d07a06f474c8d/reports/47fb7a7c-54c2-495c-8134-31817d8c8ada/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/718bd463-7e1e-4a44-8021-0080bdc012d7

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1120807

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2022-11-24 23:39:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pcoaick2czup6oanktec2mbqhkk2enaukhumvzft3oj6k554zoeq._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:newyear2023 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/221125-bxdrnacc56/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

185.106.92.111:2510

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d2ca203f-2bfd-4c27-9840-4b55400e4b9d

Unpacked files

SH256 hash:

41e7b1a4320cb36f0b8677c05070c96dc4b64d9a3c4092cf8be5cdab48050036

MD5 hash:

cca2b26ae49f850e44c57c9a010b0e8e

SHA1 hash:

495a3751ef969b44e9ef61382adf9747d79eb221

Link:

https://www.unpac.me/results/6df688b1-8eca-4684-ab85-3666545cd97e/

SH256 hash:

b7fbdfef210e41b4eb488a9d53da2ddd9383d6ee276004a4338c45717a15ab12

MD5 hash:

c670aa7f7beade472935285c4fa82b67

SHA1 hash:

44d1e023ad422fc34ecdfd1d896f7132c47aaf4f

Detections:

redline

Link:

https://www.unpac.me/results/6df688b1-8eca-4684-ab85-3666545cd97e/

Parent samples :

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a
a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825
789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89
a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e
91a8f365008dfc8e9fab751f78472882c1cfacb909b290900fd2788cb9feeb6b
2a89f391b53ed6f4ff5c29efee712d7f56fe531e04db633df67d0d5d28907609
b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178

SH256 hash:

4bec9b6cfdd19366306ab9f28d3a2d7cca44c0c87d49ead7a1ee40daff1e249d

MD5 hash:

608f7e518904c5f6be21d0c9ed02926f

SHA1 hash:

0b21d019634b4634da16666158cac785bfe55c74

Detections:

redline

Link:

https://www.unpac.me/results/6df688b1-8eca-4684-ab85-3666545cd97e/

Parent samples :

a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825
789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89
b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178

SH256 hash:

789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89

MD5 hash:

f9598543bf08aca31ef98a86d526d440

SHA1 hash:

a796a9ab04b57c66b4261cf5cb2954d739da4a96

Link:

https://www.unpac.me/results/6df688b1-8eca-4684-ab85-3666545cd97e/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/789c04095a16/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.