MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 816ba07d828978228709f49586655c2c3a36171480a10c2e75b93aedc6ca4972. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 1 File information Comments

SHA256 hash:	816ba07d828978228709f49586655c2c3a36171480a10c2e75b93aedc6ca4972
SHA3-384 hash:	60791920b93e26e718d57339bc2d93323984e6aa41661e1aaa9926914acbf26dcf2c021171bfe70c08504ee4267bf9b7
SHA1 hash:	46c62d58b190e66fafa6e671552b905d15d0834d
MD5 hash:	8d577e02aa5b292469821a5f6ad3c652
humanhash:	iowa-london-aspen-connecticut
File name:	816ba07d828978228709f49586655c2c3a36171480a10.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	309'760 bytes
First seen:	2022-08-15 23:00:37 UTC
Last seen:	2022-08-15 23:57:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b5d12f5a09f6df43d90c323a3e09a9d6 (3 x Smoke Loader, 2 x RedLineStealer)
ssdeep	6144:BbR4+prQHDPO/+U/kBou/YCNK77T4wL6K9pvP0OWGQiI:BdFp0jPOGBoGHNAAwXXpNI
TLSH	T11764E1B0F691C472E46216344832DE71993FBC26A674868733A4371E7E722C3657AB1F
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	4a8c062e32368ece (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
5.61.37.70:38427

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
5.61.37.70:38427	https://threatfox.abuse.ch/ioc/843371/

Intelligence

File Origin

# of uploads :

# of downloads :

317

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

816ba07d828978228709f49586655c2c3a36171480a10.exe

Verdict:

Malicious activity

Analysis date:

2022-08-15 23:03:42 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/637fc529-28bc-4826-a9fc-993db9155873

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/298840/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.30455.16579.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/29047/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed ransomware

Link:

https://www.filescan.io/uploads/62fad06c810e2831b74ecaad/reports/ffcdfe8c-e1c1-4258-b0e7-f10880ff6973/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/13123ea4-2fe7-4ac0-a13e-45580afa6a6c

Result

Threat name:

AsyncRAT, RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1051939

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected AsyncRAT

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/816ba07d828978228709f49586655c2c3a36171480a10c2e75b93aedc6ca4972/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2022-08-15 22:52:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qfv2a7mcrf4cfbyj6skymzk4fq5dmfyuqcqqyltvxe5o3rwkjfza._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220815-2zh29sghdp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

5.61.37.70:38427

Unpacked files

SH256 hash:

ee729f4318a1760ba6434d60eaed91a912569ded5de5854f82b528b3108cef6a

MD5 hash:

bbb36b1edffe6f18fa1b008d1ffc1271

SHA1 hash:

da3c5834de1e003f4bcf08dd91cb4b17e0f4d05e

Link:

https://www.unpac.me/results/f4102437-6ffe-4203-8fe4-2a8a668bfb12/

SH256 hash:

c1bad1fe5b9bee04a33a5387171702e8851c779f886e39e21438e7b8aac265f8

MD5 hash:

af3e31c8fbf7ea7055a6ba2f125a3f05

SHA1 hash:

75e7437d5480655085ae7556f3583805505bb218

Link:

https://www.unpac.me/results/f4102437-6ffe-4203-8fe4-2a8a668bfb12/

SH256 hash:

941d867a983d900d50f6ae160b890a7e5ff9e178e8ef2dab2b47fcbb3f994bf8

MD5 hash:

1d50686beaa02b404bdad220b9d430a5

SHA1 hash:

3b1f2a2d10a5b6e253b1f509f3e85e30bd5aa351

Link:

https://www.unpac.me/results/f4102437-6ffe-4203-8fe4-2a8a668bfb12/

SH256 hash:

816ba07d828978228709f49586655c2c3a36171480a10c2e75b93aedc6ca4972

MD5 hash:

8d577e02aa5b292469821a5f6ad3c652

SHA1 hash:

46c62d58b190e66fafa6e671552b905d15d0834d

Link:

https://www.unpac.me/results/f4102437-6ffe-4203-8fe4-2a8a668bfb12/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/816ba07d8289/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/816ba07d828978228709f49586655c2c3a36171480a10c2e75b93aedc6ca4972

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.