MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 80e78163acd3b14cc83ce01c8a9203236cfde0dedbc98259ff9e88b230982b32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 14
| SHA256 hash: | 80e78163acd3b14cc83ce01c8a9203236cfde0dedbc98259ff9e88b230982b32 |
|---|---|
| SHA3-384 hash: | 9f959f92c99ffb833b474cf6dfd6068415bdf22fcd8dfcb9fbfa1d4e76974dc87349508d7f13db922f83a0aee8263058 |
| SHA1 hash: | acc545bf4929aeb6a3ea4bb7efc679dea4400059 |
| MD5 hash: | 6ecb32fe0a776fe3b4db33e7afb17b1c |
| humanhash: | april-december-iowa-vegan |
| File name: | 6ecb32fe0a776fe3b4db33e7afb17b1c |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 349'696 bytes |
| First seen: | 2022-12-25 12:40:31 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7b9daca6da068f54ad4e1900288e8efd (6 x Smoke Loader, 4 x RedLineStealer, 2 x Amadey) |
| ssdeep | 6144:oLARTwjw4+lFhtqnXBykiHHimXp3WCLaratkJRXX4KDJ/plyGymI:oOYWkiHH93vJtkJ57DVpYm |
| Threatray | 12'579 similar samples on MalwareBazaar |
| TLSH | T19A74E0207690CC22CAD249755D2BDBA82F3B7C618B6359F726086E5F7E302B17967307 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 9a9acedecee6eaee (119 x Smoke Loader, 44 x Amadey, 41 x Tofsee) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
6ecb32fe0a776fe3b4db33e7afb17b1c
Verdict:
Malicious activity
Analysis date:
2022-12-25 12:43:17 UTC
Tags:
trojan rat redline
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
anti-vm greyware packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.RedLine
Status:
Malicious
First seen:
2022-12-25 12:41:09 UTC
File Type:
PE (Exe)
Extracted files:
57
AV detection:
21 of 26 (80.77%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 12'569 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:shakur discovery infostealer spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
31.41.244.198:4083
Unpacked files
SH256 hash:
10d89dc018c4f68c4de429d05553643fe51c13ead82dd5ffe77ca6ce3da0bb04
MD5 hash:
57e2dc37dcb1345f2eb161a54cec3e83
SHA1 hash:
f32b2dc4905b6f0bf9bf28376b58773ca6c79852
Detections:
redline
Parent samples :
41f7de00c520011be602acf6cee0b2d6342729621336ca9c2f5da205ee3af85c
86fe0a5aae7bcf333119902b9e2bbc5464fb0a89391b5534898f45680fcae9e9
ca8b74d4dc1ff0b5876a702b0ac9450854ed7219cf968c94dd02d7713c8489e5
8b0ac449b6ad803b6141bf9807c0178b22e83e48028a5a64dff6c5c5be3a8ff9
80e78163acd3b14cc83ce01c8a9203236cfde0dedbc98259ff9e88b230982b32
114bc4570edf3732d88f11383a7fbe4eb8a92417193f9d098ba095a86b5a60aa
46e8f1e77e132152528af8fea7bc9fe5d08df40b4222d6e91f61cfc0866e73e8
0edbf92ba8990787fa99d173c29e093b379f258ad5a4b3804ffeb5b9e3b2d559
a2a4eb343f2232af93c5efd694668f7b643593c8cc312e6ce81d7e90f5a61a5e
e56e9ab8b567b715b48f14a6c2cb425da1aa3b9df482264c37cd4000bdad99bc
86fe0a5aae7bcf333119902b9e2bbc5464fb0a89391b5534898f45680fcae9e9
ca8b74d4dc1ff0b5876a702b0ac9450854ed7219cf968c94dd02d7713c8489e5
8b0ac449b6ad803b6141bf9807c0178b22e83e48028a5a64dff6c5c5be3a8ff9
80e78163acd3b14cc83ce01c8a9203236cfde0dedbc98259ff9e88b230982b32
114bc4570edf3732d88f11383a7fbe4eb8a92417193f9d098ba095a86b5a60aa
46e8f1e77e132152528af8fea7bc9fe5d08df40b4222d6e91f61cfc0866e73e8
0edbf92ba8990787fa99d173c29e093b379f258ad5a4b3804ffeb5b9e3b2d559
a2a4eb343f2232af93c5efd694668f7b643593c8cc312e6ce81d7e90f5a61a5e
e56e9ab8b567b715b48f14a6c2cb425da1aa3b9df482264c37cd4000bdad99bc
SH256 hash:
05eec1edd8275b5826ba33d3a0972036ab3ebf1498b60db3caaf5680adeddef4
MD5 hash:
9502ded7672e6f0355333a2740b54da0
SHA1 hash:
39e1855154819ddf048ebfc7ead1a071392ac0b4
Detections:
redline
SH256 hash:
cd762a88c2abde591ec9d8a08b0d5d294d942a28085c88b47711e3650560a855
MD5 hash:
b32321503e273118774201c42a5b185f
SHA1 hash:
1d08f10d5f775a53a4b6d8f6a5547af1a279a002
SH256 hash:
80e78163acd3b14cc83ce01c8a9203236cfde0dedbc98259ff9e88b230982b32
MD5 hash:
6ecb32fe0a776fe3b4db33e7afb17b1c
SHA1 hash:
acc545bf4929aeb6a3ea4bb7efc679dea4400059
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
| Rule name: | Windows_Trojan_Smokeloader_3687686f |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://62.204.41.165/most/slova.exe