MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 1 File information Comments

SHA256 hash:	829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82
SHA3-384 hash:	209e5eb1a27bafc58d630b2d0d506b84c3303ae459ba08e13c1e87fabfb7005bd12aa100fddd44abd28beb2db4b1e3e0
SHA1 hash:	91bc40b24745fd839bbb16a59d86576d67e984e5
MD5 hash:	9122b88a7376f51d049522cf9a234478
humanhash:	arizona-idaho-island-fillet
File name:	829225fc19a57409d03967926eeb1ee6b4da7184af8e2.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	360'448 bytes
First seen:	2021-11-09 11:31:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef5891f13814421fd185279f57d98085 (7 x RaccoonStealer, 4 x RedLineStealer, 2 x ArkeiStealer)
ssdeep	6144:40oL4JoQ1sycyMnm3T8R5ghjsi+ioQfeIEgfuTxgsa6VFSRQvoYLAqi:bQ4JoQ1sryMY0S4QfLsxgsa6VKaoYU
TLSH	T15B74D000A7E0D035F6B712F85A7983B8A83F7EA1672085CF62D516DA9675AE0FC70317
File icon (PE):
dhash icon	b2da8abecee6baa6 (2 x RaccoonStealer, 2 x Stop, 1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
185.183.32.184:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.183.32.184:80	https://threatfox.abuse.ch/ioc/245195/

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/204447/

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/618a5c3aa00afa9663a1d967/reports/bd54a1cd-18e0-4910-96c2-5064c2c393fa/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/198ff3a1-43b3-4bec-8fa6-a264a02d6979

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/885918

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-11-09 11:32:07 UTC

AV detection:

19 of 44 (43.18%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qkjcl7azuv2atubzm6jg52y6422nu4mev6hcl6ap725gmm5unsba._file

Verdict:

malicious

Label(s):

asyncrat

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:1132044836 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211109-nnapvscbel/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.183.32.184:80

Unpacked files

SH256 hash:

9c6341b148ac2906f5c468d3932d5df78a8e08065a90a3598f3479aa459efed2

MD5 hash:

e622241b33225aae0481873b413fc903

SHA1 hash:

daf8a3224ba1cf5574f7f0136d1ecbbd12e6eb00

Link:

https://www.unpac.me/results/fa696701-3a4e-42a2-9a00-a4ac796b2b3a/

SH256 hash:

50687c5fcbea892e716126ce15f26dd5a6c6c1bdde4c36c96cd1c7be01d42e3e

MD5 hash:

44078bb2ace528e95b142dbf29b17043

SHA1 hash:

c74b4fab6319804b09a087eab35f2f8c31238f13

Link:

https://www.unpac.me/results/fa696701-3a4e-42a2-9a00-a4ac796b2b3a/

SH256 hash:

b530575b72400c2e1234035e06f23b71cbda53c846cf66d13eeffaf5b53fc854

MD5 hash:

dde07eaa7dec57b2b69b3bf17c7bbf97

SHA1 hash:

224b8ef1870a054fe22930aa4fd85334017d35d6

Link:

https://www.unpac.me/results/fa696701-3a4e-42a2-9a00-a4ac796b2b3a/

SH256 hash:

829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82

MD5 hash:

9122b88a7376f51d049522cf9a234478

SHA1 hash:

91bc40b24745fd839bbb16a59d86576d67e984e5

Link:

https://www.unpac.me/results/fa696701-3a4e-42a2-9a00-a4ac796b2b3a/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/829225fc19a5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.