MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8060118a30512a3fd3f94d239cc38b00cdd956f6803af96e477857ae18d509a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments 1

SHA256 hash:	8060118a30512a3fd3f94d239cc38b00cdd956f6803af96e477857ae18d509a0
SHA3-384 hash:	3c858afad6134b942079a80a10cc56f46ddb79fe0dca67dbe88f81e7578b03443abee663391d0861eff72a3d4ceecde4
SHA1 hash:	39a6199a3166690e6d7a32e42f85989f46435aee
MD5 hash:	4ca452f6bbb735dc35d592b1b9c6f709
humanhash:	avocado-mockingbird-network-ohio
File name:	4ca452f6bbb735dc35d592b1b9c6f709
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	379'392 bytes
First seen:	2021-10-06 11:46:12 UTC
Last seen:	2021-10-06 13:06:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d33805713bf84c5172011e6ee58dcc60 (6 x RedLineStealer, 2 x ArkeiStealer, 2 x RaccoonStealer)
ssdeep	6144:V0O7pPxELkbwSTnEEiJOP1HRTM3EIqdwHvRekuLROhxxpeTr/ekI:578awSTnEl0P1HRTM326Hp5zxp6L
Threatray	3'960 similar samples on MalwareBazaar
TLSH	T18184DF093280DBF2D6720631BB12C7F54A7DBC5D5C2A924F6B98EB1E6E39391CE25305
File icon (PE):
dhash icon	fcfcd4d4d4dcd8c0 (52 x RaccoonStealer, 28 x RedLineStealer, 6 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

270

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4ca452f6bbb735dc35d592b1b9c6f709

Verdict:

Suspicious activity

Analysis date:

2021-10-06 11:48:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/efa3555d-e0ad-46df-b2a2-7f79b39af593

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/195455/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.30979.28950.3017.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/aecf556f-ec8b-461e-befe-5b8385586b39

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/865512

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redlinestealer

Link:

https://mwdb.cert.pl/sample/8060118a30512a3fd3f94d239cc38b00cdd956f6803af96e477857ae18d509a0/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-10-03 18:36:41 UTC

AV detection:

33 of 45 (73.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qbqbdcrqkevd7u7zjurzzq4ladg5svxwqa5ps3shpbl24ggvbgqa._file

Verdict:

malicious

RedLineStealer

220cc23821dc51e1de7ee0e492cef0c0fe9b3785baf6fcee88f56fcbae576bed

RedLineStealer

2fe3f6fc8b9b9f4d1bddc0e97ddd64229da2a069cf199bcd435d14a3e27e4e19

RedLineStealer

3eab904378106422ddb6fac7d20dd694919c0b69fe09231435d781e0f1507e0a

RedLineStealer

51d53ea96cef125f782633f97ae3e7bfaa19c50aeed07186ce85f0b09e7f4446

RedLineStealer

6223f08f2ea185a1cbcef1085ae6bddc64806e80a982acbe8cfb0056de0594a8

RedLineStealer

64fa435686d94f74a3cc546fed84efea58c1ef60454ad9f60939960fadcbaa54

RedLineStealer

a0e565d4dabe4fca53afd035b7c4c0ec68d79e1655042ce42c38e85f18e3dbfe

RedLineStealer

c569326abd44e1e6d0b0a843c41f39c8b06bd1e0085233bdb4024a2289a811cc

RedLineStealer

f59e70c1e2703fd8d6016bad2f6b4ebd7824b52eab2bf63a0fdc96f0a3d16011

RedLineStealer

+ 3'950 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:udp infostealer

Link:

https://tria.ge/reports/211006-nxv26abcgq/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

90b0e7d902727351e4a88f3b02c2d3d15d202b2a0ea118c961c21c258617c1cf

MD5 hash:

6ac070b383c57c84bce059f1611a8bc0

SHA1 hash:

f8768f72c0cc63945cbe31b75e39a9d207db06b5

Link:

https://www.unpac.me/results/20e41433-531e-4a98-96dc-bab5314888b8/

SH256 hash:

74ec8e7f6661e87226bb95a4ba97ae828c45f3142b78d068492cff7162bbbd47

MD5 hash:

f007c18cee4cbdd6992122a8a216ccc0

SHA1 hash:

5b931b76947bb4484ae7b94a60e83c65f92b21b3

Link:

https://www.unpac.me/results/20e41433-531e-4a98-96dc-bab5314888b8/

SH256 hash:

fc667313899f6647f9d67a16af1234ac6b109223b7c3ce0d178614985cfd27e9

MD5 hash:

24eb234842defb045592109e300bed32

SHA1 hash:

4fa3017ddf932a7f7ae7fbbeda7eacbea609f283

Link:

https://www.unpac.me/results/20e41433-531e-4a98-96dc-bab5314888b8/

SH256 hash:

8060118a30512a3fd3f94d239cc38b00cdd956f6803af96e477857ae18d509a0

MD5 hash:

4ca452f6bbb735dc35d592b1b9c6f709

SHA1 hash:

39a6199a3166690e6d7a32e42f85989f46435aee

Link:

https://www.unpac.me/results/20e41433-531e-4a98-96dc-bab5314888b8/

Malware family:

RedLine.A

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/8060118a3051/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8060118a30512a3fd3f94d239cc38b00cdd956f6803af96e477857ae18d509a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.