MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 856f9a9e8136931cd0a1a600755213f8dc5ed890a1606a91803178de2c677d48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 2 File information Comments

SHA256 hash:	856f9a9e8136931cd0a1a600755213f8dc5ed890a1606a91803178de2c677d48
SHA3-384 hash:	3d3dcf9c841267f7a2acda1437ad0f076f5095d46a0cf92f7fc32c6421d8791344ad1115fbf624f243aa503b8ef04e5f
SHA1 hash:	da0acfd45508963f3eb0c788e018aea863233176
MD5 hash:	dc357d936bdc7b008eb1107819d26905
humanhash:	summer-bulldog-virginia-jersey
File name:	SecuriteInfo.com.Variant.Fugrafa.260198.23845.7432
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	340'992 bytes
First seen:	2022-07-10 08:39:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6d82463d0c4be8b6f6bfb991a6cc34af (18 x RedLineStealer, 1 x Smoke Loader)
ssdeep	6144:Q6qI0lx1gNcntnI0LDn/GSFlCmI7bJbLIlZiQj3WBk0fmeoG4e4iga:Q6nqx1jtI0Lz/GSnCPb+viRk0f1oGp
Threatray	5'921 similar samples on MalwareBazaar
TLSH	T16974DF81BBA1C471E0A21D3014358BF52A3BBC636B3496CBE3A47B2F2E703D159B5756
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	c01edecea68c8ccc (154 x RedLineStealer, 98 x Smoke Loader, 36 x Stop)
Reporter	SecuriteInfoCom
Tags:	exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.233.48.49:41386	https://threatfox.abuse.ch/ioc/823199/

Intelligence

File Origin

# of uploads :

# of downloads :

268

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/285863/

Detection(s):

SecuriteInfo.com.Variant.Fugrafa.260198.23845.7432.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/24835/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypter greyware packed ransomware

Link:

https://www.filescan.io/uploads/62ca906376fa5a599453f4e7/reports/3189c4b1-39f0-43db-b18c-92d535a1ea39/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/28a1de11-53a1-458e-9083-3fead222e336

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1027943

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/856f9a9e8136931cd0a1a600755213f8dc5ed890a1606a91803178de2c677d48/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-07-10 08:40:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 26 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qvxzvhubg2jrzufbuyahkuqt7dof5wequfqgvemagf4n4ldhpvea._file

Verdict:

malicious

RedLineStealer

602000394de3c94f4b6427c4ac6ffdba915aa87ccf5a178109daafaa34e1f3ac

RedLineStealer

716b591fa8d603b4b8aa3ae6e213e5c51ced9ae90ac6d1cd33c1d5545b8fb1af

RedLineStealer

7c4545408844001956ea3dbff168e6eedb30b383e34e2679351f7f696e4dec29

RedLineStealer

a216ef6daa1e2e1fd88e6a6a7f643b32df1527c98309b21ebe582fdbff820c48

RedLineStealer

a25e7096965a6cc95b9d352393dcfee78735c051cb08840d479ee5106474cdc7

RedLineStealer

d54ac4512ec628667e1824e1369727de79f9498dcd00bf7d0f83d9e13b5f39eb

RedLineStealer

d5ef538b968f2951b0018ac85e4a064690ddd9f4658d6095472367642e3d0816

RedLineStealer

f1c9dc77f406f186381bc88d7d5b3a92dc8145d62ac40b6632112ce252f7a606

RedLineStealer

f6b8572ebb542f8aab78f3211a171335b0d8b0b6cb8e7d30185f40837a208056

RedLineStealer

+ 5'911 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:some discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220710-kkvzvadca5/

Behaviour

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

193.233.48.49:41386

Unpacked files

SH256 hash:

50c33bba08b51904bc7e44584499149fbfa1e7056787ffd1537a1c6fb758db27

MD5 hash:

ed27be13ce3743ac0227673982b027db

SHA1 hash:

b894151687593a95d5bf10140b190988a20b3190

Link:

https://www.unpac.me/results/26ea03e4-216a-4243-9fba-58e954e653c6/

SH256 hash:

b7103c69ac8498816a335cfbb2dc88b17c23ce7dcb1c818b2ddbcca658385e2e

MD5 hash:

a1b51f8ecbdfd557ab99823aab692f96

SHA1 hash:

87da6ea563ba821d7b703cbca0e6fcf91f213408

Link:

https://www.unpac.me/results/26ea03e4-216a-4243-9fba-58e954e653c6/

SH256 hash:

056a337dff86016d01e220bf8f979f782f5c98692cf3271b82f0b6d10950497f

MD5 hash:

e38d9eaee830c2cfceb8110b2d16ecb7

SHA1 hash:

4e1e4676acf84ceaf0c15d17b5a91e19a47d5449

Link:

https://www.unpac.me/results/26ea03e4-216a-4243-9fba-58e954e653c6/

SH256 hash:

856f9a9e8136931cd0a1a600755213f8dc5ed890a1606a91803178de2c677d48

MD5 hash:

dc357d936bdc7b008eb1107819d26905

SHA1 hash:

da0acfd45508963f3eb0c788e018aea863233176

Link:

https://www.unpac.me/results/26ea03e4-216a-4243-9fba-58e954e653c6/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/856f9a9e8136/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/856f9a9e8136931cd0a1a600755213f8dc5ed890a1606a91803178de2c677d48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.