MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a21fc074308e3ea2e0386745c715366d9178364ffab0255dbd2781e3d9e2285. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs 1 YARA 1 File information Comments

SHA256 hash:	7a21fc074308e3ea2e0386745c715366d9178364ffab0255dbd2781e3d9e2285
SHA3-384 hash:	473c598e72febb25a4adb8a21ef7b133b0abbf864626cdddba0db75b9ab1f69526a3723a2546626c3d2815431316ac92
SHA1 hash:	75bcc778766227f200d931bf0e34bec134d55b58
MD5 hash:	9b626aeedcffd22a08af0eb71dc3b87a
humanhash:	twelve-sink-colorado-johnny
File name:	9b626aeedcffd22a08af0eb71dc3b87a.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	366'080 bytes
First seen:	2021-05-28 19:46:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	21bc2abc7abc74c14de331c664d0c669 (4 x RedLineStealer, 3 x Stop, 2 x RaccoonStealer)
ssdeep	6144:LMfap+88bjw3MIzG0ChGXqPwygoUEh3gl9WH1ydURhMgX+Uz:LMfap+88bAMIh20qVgK3glEH6URhh
Threatray	2'099 similar samples on MalwareBazaar
TLSH	C974AE11A7A1C038F5F212F44A7592B8A63E7EB167B490CF52D52AEA5A346E0FC31707
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
185.215.113.17:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.215.113.17:80	https://threatfox.abuse.ch/ioc/66366/

Intelligence

File Origin

# of uploads :

# of downloads :

176

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1ca5c9e6c8736a4eb196e11784a1efed.exe

Verdict:

Malicious activity

Analysis date:

2021-05-28 19:31:46 UTC

Tags:

evasion trojan loader rat redline

Link:

https://app.any.run/tasks/a44b9c39-2040-49ef-8c73-f92e7035801e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/163067/

Detection(s):

SecuriteInfo.com.Mal.Generic-S.25946.4162.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/794124

Signature

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a21fc074308e3ea2e0386745c715366d9178364ffab0255dbd2781e3d9e2285/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-05-28 14:19:07 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=piq7yb2dbdr6ulqdqz2fy4ktm3mrpa3e76vqevo32j4b4pm6ekcq._file

Verdict:

malicious

RedLineStealer

3622c63a1e0fb6cc737b3face306b45ea39c26140dcf10be8d1dcfa90cc2df8e

RedLineStealer

7341c40c1693ae8350ec3eb83cce1d9e0744340b3dde2241e146b410f54c191b

RedLineStealer

88d9a8f5995b204905d44e49a90679acf5c3d83b0623b9391dedcb243fb52d41

RedLineStealer

90823e9bf099b873263241a2a7c3435b85fe6480ecb4fff4da9563ba95e7b31e

RedLineStealer

b16c67c196a1cc559f521eeac0052b0025b0eac9afdc5a25c6d8d7e7a611b37c

RedLineStealer

cd661266f7067a157d4e04654ba155341e544a36e3a3c430afc230ba015c3f5a

RedLineStealer

cdf3b92214030125e3c8f87d4b019f955073d76c2da279c2a2fcd2d9591aed2a

RedLineStealer

ebed275eba9f8eddb2242c93732b7a213ede149bd79a792de9d6f8dda6d7f3a3

RedLineStealer

faa254ca57ec7188939dc6b75b65b9e018d3152c5adb2953daaea28fd4044b69

RedLineStealer

+ 2'089 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:mix 27.05 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210528-62frvywbv2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.215.113.17:80

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7a21fc074308e3ea2e0386745c715366d9178364ffab0255dbd2781e3d9e2285

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.