MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 4 File information Comments

SHA256 hash:	7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710
SHA3-384 hash:	2aa6d6f35bda4f93df257054ae872380747f92d98532f2ee00adae422a24a57f44205f4a5c14d662acb0481dfa8e095c
SHA1 hash:	38f63f33295172133a1f24594cb4e7c51ad747c2
MD5 hash:	37a2f855a7bf0617e6e1a56b0ffe930c
humanhash:	alaska-fourteen-oklahoma-hamper
File name:	37a2f855a7bf0617e6e1a56b0ffe930c.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	378'880 bytes
First seen:	2023-07-20 10:12:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2c1d6f07319e916f23334deb261840fd (5 x RedLineStealer, 1 x Glupteba, 1 x Amadey)
ssdeep	6144:d0T/LcisCDim3MIvAW6dkMIHyUaXWNTFTE0/S:ds/Aih+m3BvxUdiyjXITFR/S
Threatray	153 similar samples on MalwareBazaar
TLSH	T137840983C7A23D49E9278B729F2FD6E8764DF2508E49777D1218DA3F04B11B6D1A3620
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	000808080c070400 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
178.32.90.250:29608

Intelligence

File Origin

# of uploads :

# of downloads :

250

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

37a2f855a7bf0617e6e1a56b0ffe930c.exe

Verdict:

Malicious activity

Analysis date:

2023-07-20 10:14:32 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/ef899cd0-df37-4ca4-b5de-9c74f17750e7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/425962/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed xpack

Link:

https://www.filescan.io/uploads/64b908edbf0894a95b6ee09d/reports/29424a62-9f11-45fb-815c-f71d4e90f36e/overview

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f4638f70-20d3-4de2-b8a5-26f6f02fb3c3

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1276686

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redline

Link:

https://mwdb.cert.pl/sample/7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2023-07-20 10:13:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 25 (84.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pqpzo6r3mb62wopoqdgo6ojjfhydrru5ovzq4oebaensslcrq4ia._file

Verdict:

malicious

RedLineStealer

3165f664c4c755bd9715a7f004b98f1990a2055aa1ca4ab8ea75bf2d7730dfcc

RedLineStealer

3d9868ef3b6c60ebe9ef766672923f57253ac74cd5bc2592e2d62bb984b5f95d

RedLineStealer

64365156896ff3b41790a7b0dd38bf1efb985a4e5e35135883b34ea69a85b508

RedLineStealer

7518f251ed3872355b637119033fd40e900fdfcd2955425f243951f40279bcfd

RedLineStealer

75f9db664373b1e957799e65139d1468c7cc7f39ce171c100b875d886cda0690

RedLineStealer

7ed395afebf774d7e1e0ce47b88445afc2a8b9811c94553f6923ba4496ce9962

RedLineStealer

a8ab824da87f6df5db7402a67edca0baf3b2da422ab48dbded3d03cb9e137ed5

RedLineStealer

e4bb056a390bf88d2e2b2f578b5a4cbb6b4eb9d19a8f7998642bd46585bd99ec

RedLineStealer

e8d7197a7c6ba760b398ebe50fb5ca8770e454fca9da731438eb329b8db56c3d

RedLineStealer

+ 143 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:logsdiller cloud (bot: @logsdillabot) discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230720-l836ssfh41/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Malware Config

C2 Extraction:

178.32.90.250:29608

Unpacked files

SH256 hash:

fd7fcb15664a8d6b15f986edf7b1b89ac04fd0b7e2c75ba51f2d7be2b16bd25e

MD5 hash:

226ebe2b896adda7d7ca7808c7830e79

SHA1 hash:

dbc7a3619f3ae0e77d983718ddf7447ff9aa2e0c

Link:

https://www.unpac.me/results/b1b981f6-5439-4cb0-a217-7bd983f7238b/

SH256 hash:

055d23615d232b3b26dce994eb4e011505be13199c97610974f011bba0adc805

MD5 hash:

84fdf79fc25c72aa2a12972d25e8476b

SHA1 hash:

72288d6450b272481eb9a606367f7ee848427f98

Link:

https://www.unpac.me/results/b1b981f6-5439-4cb0-a217-7bd983f7238b/

SH256 hash:

6b50f48dd61d0e8af9d39ec9c4326a28cd3298e8b336bfdd5c81cd3db2bb1e54

MD5 hash:

c5634c071c4a20379d58bf9e5f4d9a8c

SHA1 hash:

3c5e48ad01611b0c79b204ec398c9b3d8a30a21e

Detections:

redline

Link:

https://www.unpac.me/results/b1b981f6-5439-4cb0-a217-7bd983f7238b/

Parent samples :

d3c8faef1fc611343ee8bdd7462c6c9e0b90394da533475f46a518bb2c63329f
7db1063bd97bfec377245750eee13f04b2e28bd906ab67b8df9d78e0b8d7b413
a080fb72f5167c76a0076864e959058168d7fdf22699e51b865adc0688eebac9
69a41b421b0a89e91a5bda32b1d8ab7067cfa1d484134733f5a2b6355ed9025b
7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710
b1ef8e8fc35cc8f9646a29e93322ce23de31a21825ef867ba9bf903a203d5efa
f4fed6410af40a0441fd09c9f8d2b203938d46b8ae18dd75f6ea78ac9f675a2b
0ffe096e263b93450e971cb1485fd907b6572638228a1cd9ddd1575a866c6cc9
cdbfb15564317948c800599bf4e4ae31ca937d89a716dc1bf52752e10fa7980a
732c6933975284af9ff5eb21fb1f667a66c0751cd2dc87cb87e352dfa8918ee3
6cbe4e43208d3edd0da509a7bf7bd1a17b8cdd81806eb7107ab26adc633c4ae2

SH256 hash:

6178ca1d58de3919bbb2953d0571abab36e10d95f83624ec6cd174b1d29aade1

MD5 hash:

92466a9033e3c20a4a960a352ddc1781

SHA1 hash:

35716bf3775bd1662e9359d74fbcbcfcc8427709

Detections:

redline

Link:

https://www.unpac.me/results/b1b981f6-5439-4cb0-a217-7bd983f7238b/

Parent samples :

SH256 hash:

7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710

MD5 hash:

37a2f855a7bf0617e6e1a56b0ffe930c

SHA1 hash:

38f63f33295172133a1f24594cb4e7c51ad747c2

Link:

https://www.unpac.me/results/b1b981f6-5439-4cb0-a217-7bd983f7238b/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7c1f977a3b60/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c1f977a3b607dab39ee80ccef392929f038c69d75730e3881011b292c518710

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/