MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80f1733714b6e0482a7696381bbfba3a142de5d1905f7c2228023231d648aa14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80f1733714b6e0482a7696381bbfba3a142de5d1905f7c2228023231d648aa14
SHA3-384 hash: 03b69dfee15d47e03ad0ab2b8928c7fe25b3e9a778fc075be5fb0f023bbda8e69c8b6723c9e5a2d991e62597647045ea
SHA1 hash: 53299d1f5b159d69b4cee0bb64ce5b993e009441
MD5 hash: 05b7703c8415f994b2a2f6d6dca554b8
humanhash: enemy-summer-nineteen-arkansas
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'498'048 bytes
First seen:2022-10-27 14:50:05 UTC
Last seen:2022-10-27 16:23:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 08569e64bf889aa1485728956b8b0f52 (14 x RedLineStealer)
ssdeep 49152:D4NPNiYDgLtI/fQsCTnuc8Qe2Ts9xCBFdBLKag839dKNv:D4NutInHEuc8Q3TsfqFivM4J
TLSH T1BEC5D0633586C4B6DDA681F5006DA9BE417D88349B310DCF52C42FFEE5F58D12E328AA
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://79.137.192.57/tool/softwinx86.exe

Intelligence

File Origin
# of uploads :
22
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-10-27 14:50:40 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/b2b3631e-fcd9-4de8-b272-0161d9a51f56

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/324931/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.31725.17408.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45999/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/849329a1-6af2-44ad-97af-945e6616e6b8
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1099470
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80f1733714b6e0482a7696381bbfba3a142de5d1905f7c2228023231d648aa14/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-27 15:21:12 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdyxgnyuw3qeqktwsy4bxp52hikc3zorsbpxyiriaizddvsivika._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:1310 infostealer spyware
Link:
https://tria.ge/reports/221027-r75wwscedm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
RedLine
RedLine payload
Malware Config
C2 Extraction:
79.137.192.57:48771
Unpacked files
SH256 hash:
f1f14e9dd4215bdc7422154c03618f43d37a3553d2d6cf019ca312fde320e3f7
MD5 hash:
0f54b4a0ecd7a5c8106c156917f657c2
SHA1 hash:
d5a90eb22eaa4173d2b269be1e99e4c5154e35bd
Link:
https://www.unpac.me/results/3e137621-ac1e-44eb-8507-fc950cae9499/
SH256 hash:
80f1733714b6e0482a7696381bbfba3a142de5d1905f7c2228023231d648aa14
MD5 hash:
05b7703c8415f994b2a2f6d6dca554b8
SHA1 hash:
53299d1f5b159d69b4cee0bb64ce5b993e009441
Link:
https://www.unpac.me/results/3e137621-ac1e-44eb-8507-fc950cae9499/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80f1733714b6e0482a7696381bbfba3a142de5d1905f7c2228023231d648aa14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2378332/
Cape
Cape
https://www.capesandbox.com/analysis/324931/

Comments