MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ad0f14d763cfe8710a7bce6ccd3bb6589d059142d2662800f2b4f81e3cf2737. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ad0f14d763cfe8710a7bce6ccd3bb6589d059142d2662800f2b4f81e3cf2737
SHA3-384 hash: e4f6d3f55379e3490175d6ce0ded57363b54197b27d40b196816c5fded8b48334f7507e81972856b7a58fd24648d36cb
SHA1 hash: d843ef4911f12d0022f7ec5913511ac43e87f786
MD5 hash: f0c59fbbb0be1b5a014398b96f56610d
humanhash: charlie-connecticut-yellow-summer
File name:SecuriteInfo.com.Variant.Bulz.386199.7846.14324
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:291'840 bytes
First seen:2021-03-09 16:05:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f96f556a2d4339167385988e97f6b9c8 (1 x RedLineStealer)
ssdeep 6144:vhJQkPJl/fxVWVr8UGZMtFpJT7jzQ6DyTTndTrSpw2vlF/93:HdPDffkr+MtFTT7jnDyTZri
Threatray 48 similar samples on MalwareBazaar
TLSH 9854D01172E4C032D5D219764825C2A54A7FBCB29F3446C77B943EAEBE312E18A3E347
Reporter SecuriteInfoCom
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7047d8264ad838ace204f5f7bea52997.exe
Verdict:
Malicious activity
Analysis date:
2021-03-09 12:15:45 UTC
Tags:
evasion trojan rat redline
Link:
https://app.any.run/tasks/4a57fd05-262b-4ad0-91b0-dede7cd31264

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/123321/
Detection(s):
SecuriteInfo.com.Variant.Bulz.386199.7846.14324.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Connection attempt
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/633193
Signature
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 08:42:19 UTC
AV detection:
32 of 47 (68.09%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
24f0e4fdc443dd89162fc0a8ffebaf02708827c0a42c5095df8a70ba7bd79b01
RedLineStealer
26b1b7d448483ecb1dadeb16bba508699f3a83c3ec8e7bcfb6911a708617dd0f
RedLineStealer
514f32acee7052cb11a746b39413eee3d8292a203cb309e1c9e9f9c60bbcb26f
RedLineStealer
64ac4b2d14f86911e01c0bee904ade5fec79e4b6487626c0be4655766ddeb5a0
RedLineStealer
6c82ad6d2ac4bc7ca366d3a79bdaf96256352205ad6d645fe31ee98a1dfb1a8b
RedLineStealer
8726eeaad39b500f79072e8da7510e2b136bbc40c5ce31ab33e505beec1fc644
RedLineStealer
915a3b7045e8fc99e2361a3a4c5eae9500f8063d996771f93a96b64dd938eef4
RedLineStealer
9bf5a22089f0b74627320945df991bd1dfa37bf5522f8ecb61e5873bc6093f22
RedLineStealer
a6e43031567484437341b50ea0c165ad416ffa629e2951a0e82844dcfb27e408
RedLineStealer
adf16f6cc8d86339b88db357b9ce7698b8ccecafa0ec6ed4bf301034298bf8a8
RedLineStealer
+ 38 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer
Link:
https://tria.ge/reports/210309-zkf2dhqkpa/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine Payload
Unpacked files
SH256 hash:
66b9f5f6be97ea359229c9d9913bc0cd6234f2a2e84f1792635730f1adca85d0
MD5 hash:
20a2db8c384ff05b487ff9447d3b3236
SHA1 hash:
2eddf9cc6cda190acadffb80d5d85749b37d73f7
Link:
https://www.unpac.me/results/2446ae73-5680-4006-bae1-88706eb9c32f/
SH256 hash:
8914fba8e6af971b052f8948c8f41d8c69fb7cddb26acd33b3a6dbbd47bc79f3
MD5 hash:
7fb9cb0d7c98d4ede2867d0be1f29a19
SHA1 hash:
380eeffb64033d719e5acacec33e41461acba985
Link:
https://www.unpac.me/results/2446ae73-5680-4006-bae1-88706eb9c32f/
SH256 hash:
9a98c3fd71e8dfe22c93d702c6c327abf3c1fdf94f16ca8fcfc91d557a4ef54c
MD5 hash:
52745bf2f6f37d7e3b0614ef809c02e2
SHA1 hash:
3f3e551db2849715ff56ba18d15493ac4f809c6d
Link:
https://www.unpac.me/results/2446ae73-5680-4006-bae1-88706eb9c32f/
SH256 hash:
7ad0f14d763cfe8710a7bce6ccd3bb6589d059142d2662800f2b4f81e3cf2737
MD5 hash:
f0c59fbbb0be1b5a014398b96f56610d
SHA1 hash:
d843ef4911f12d0022f7ec5913511ac43e87f786
Link:
https://www.unpac.me/results/2446ae73-5680-4006-bae1-88706eb9c32f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ad0f14d763cfe8710a7bce6ccd3bb6589d059142d2662800f2b4f81e3cf2737

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 7ad0f14d763cfe8710a7bce6ccd3bb6589d059142d2662800f2b4f81e3cf2737

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1056715/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/123321/

Comments