MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7d94e232d215d5e0aeda7f612c0b23aa13ee0591cbc9edfaf8bd69e6b311fc5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 10
| SHA256 hash: | 7d94e232d215d5e0aeda7f612c0b23aa13ee0591cbc9edfaf8bd69e6b311fc5e |
|---|---|
| SHA3-384 hash: | ccfbf1b780b360b2515b91ad6fcd64436f6cc7744f54bcef6df7dfdcba72e94b982d829ef0c853d22037f43b4bd188bc |
| SHA1 hash: | 492ade56ed7ccf8d11ca32260a6197c5e4bb81e3 |
| MD5 hash: | ee7ea9e7c93a6267db733c193d9f79f6 |
| humanhash: | snake-shade-london-skylark |
| File name: | ee7ea9e7c93a6267db733c193d9f79f6 |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 347'648 bytes |
| First seen: | 2021-09-04 10:46:42 UTC |
| Last seen: | 2021-09-04 14:13:51 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4f8209c5b4ed49d19335a3290f6cce63 (2 x ArkeiStealer, 2 x RaccoonStealer, 2 x Stop) |
| ssdeep | 6144:6PsSOlFVo8NkkEKmPjZKAhOjLQscPYZoDUe/i3v8op/XMQcXagl:HXoGkkEJjZKeOj8PD1ecNXag |
| Threatray | 2'106 similar samples on MalwareBazaar |
| TLSH | T13F74BE30B690C039F4F721F459BA93B8B8297AB1973090CFA2D566ED07356E4AE31747 |
| dhash icon | e8e8e8e8aa66a499 (51 x RaccoonStealer, 27 x ArkeiStealer, 22 x RedLineStealer) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe RedLineStealer |
Intelligence
File Origin
# of uploads :
3
# of downloads :
406
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ee7ea9e7c93a6267db733c193d9f79f6
Verdict:
Malicious activity
Analysis date:
2021-09-04 10:47:38 UTC
Tags:
trojan rat redline stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Clean
Maliciousness:
Behaviour
Connecting to a non-recommended domain
Connection attempt
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Creating a window
Sending a UDP request
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Fragtor
Status:
Malicious
First seen:
2021-09-04 10:47:07 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'096 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:cashservice-111 discovery infostealer spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.215.113.119:15548
Unpacked files
SH256 hash:
f227e6880ca9a55fd77c782dc1e619743c218925900031fc267142159a2424ea
MD5 hash:
100d5c2a744120269c7eaff9e3b79019
SHA1 hash:
e3f2fc4beb42eb1a0a3c0486a9d50d4be6738d15
SH256 hash:
e4f0502ea096f1287857f6dc5dd22dd0930d752e1def8646d70274c7556e8963
MD5 hash:
71641d765eb1848b5424796c3aef528a
SHA1 hash:
9d2753abc76e497b0a3eb6f48d769e87fe4a0117
SH256 hash:
875ac56d4976986ce3bcd1f3246cf40b3d83eec1b536c8807f00cb368df33a03
MD5 hash:
35f6766bb6417a21feb9d1f7dbf3bdc2
SHA1 hash:
75a5036a64a204a038364294107c637d6c242191
SH256 hash:
7d94e232d215d5e0aeda7f612c0b23aa13ee0591cbc9edfaf8bd69e6b311fc5e
MD5 hash:
ee7ea9e7c93a6267db733c193d9f79f6
SHA1 hash:
492ade56ed7ccf8d11ca32260a6197c5e4bb81e3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://185.215.113.119/current.exe