MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0
SHA3-384 hash: dae5e6abe3c564ccf0cf262a5a1f8bfa72aed78e92011daf2c125454eda07546c0303bf12cc7e32179d339b930ce15c0
SHA1 hash: f5e9bd90666f80ff36dcc68b501e35cad94751df
MD5 hash: bc0f88560edfbd4782b5731f3ee7cb08
humanhash: lactose-carpet-cardinal-foxtrot
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'977'354 bytes
First seen:2022-10-03 15:56:32 UTC
Last seen:2022-10-04 20:11:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2bba10bc6e6e0c67365da76653e3e10d (11 x RedLineStealer, 3 x ArkeiStealer, 1 x ErbiumStealer)
ssdeep 49152:3XQXV7UeuVlzqiNV5qlWc0i0yf5Nh6lKa35l3l:3XQXV7Ueolz9fmvf5Nh6lB9
Threatray 455 similar samples on MalwareBazaar
TLSH T1F2D53B139A8B0D75CDD237B491CB633AA734FD30CA2A8B7FBA08C53959532C56C5A742
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc527785675_645373609?hash=hQbn9DiM3w3mGSR0KpR3IYWaCX4La7R9D0mzeXlVFR8&dl=GUZDONZYGU3DONI:1664802723:3bWQKYdvOUN7kVDTzmrwXdlW4uGt8Pgdsm1J65Gh7Xs&api=1&no_preview=1#dog141

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
69.176.94.78:32244 https://threatfox.abuse.ch/ioc/867865/

Intelligence

File Origin
# of uploads :
19
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316167/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Launching a process
Creating a window
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40883/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug anti-vm overlay packed spyeye warp
Link:
https://www.filescan.io/uploads/633b064ec9e2f34354327510/reports/9419edff-9f1b-4f84-9941-abd80ed10849/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/310c8a7d-c5f8-45e7-8733-6c193d3a5420
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1082618
Signature
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 15:57:14 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p37u6i2e5cyik7maixttugm7yfm44hf422sakydn2xqbyq3743ia._file
Verdict:
malicious
Similar samples:
40b8d2368df2682276c4040a796a2e3197877002cfc36e95e3f929d0e91c9ad4
RedLineStealer
55be88966ecabc5f5d36bc2e65d33afb8c29b5e1598414e466fc2fdfa1d56598
RedLineStealer
727be5cee6ca4efd8b66e94850461d4d1aab5757d8530d69596b2bd1967790a0
RedLineStealer
d4b8bb0d23cc76d722839af1760053357bc39708d9712af2a882019cbe696613
RedLineStealer
d8cd60c7146744671ffa478a37dd652d393bfe3383f7ae978e3b8d332d8286f1
RedLineStealer
f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf
RedLineStealer
+ 445 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:install infostealer spyware
Link:
https://tria.ge/reports/221003-tdxdrsdgeq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine payload
Malware Config
C2 Extraction:
69.176.94.78:32244
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/95ae7eb1-434d-42af-9f18-c5decd3d566d
Unpacked files
SH256 hash:
02e864279ad03f5dce0920e2c6c498160dc254b2c90b671f84b8039363f0ffbc
MD5 hash:
dcafaa429975d9a6d579f3f4f282c515
SHA1 hash:
b568554f15a17b95603286950ad7776be7597855
Link:
https://www.unpac.me/results/98cbbb9a-1597-4ebe-bf9e-df18f008a4ff/
SH256 hash:
404a23241026f66af96548c0113d21903c5f6224331a4f669d55ae097ebd8cdd
MD5 hash:
8371874d59bad6dd6e0e33e9e102eda4
SHA1 hash:
86490dbb1ecb8defd25542cbe0d84faf6f81dac3
Link:
https://www.unpac.me/results/98cbbb9a-1597-4ebe-bf9e-df18f008a4ff/
SH256 hash:
7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0
MD5 hash:
bc0f88560edfbd4782b5731f3ee7cb08
SHA1 hash:
f5e9bd90666f80ff36dcc68b501e35cad94751df
Link:
https://www.unpac.me/results/98cbbb9a-1597-4ebe-bf9e-df18f008a4ff/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7eff4f2344e8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7eff4f2344e8b0857d8045e73a199fc159ce1cbcd6a405606dd5e01c437fe6d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/316167/

Comments