MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 1 File information Comments

SHA256 hash:	863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327
SHA3-384 hash:	2cc83eb4b059214307e2cfb2681bd78346fe4a9ca66419d1fe7944cea4237d04b9f8f443292d7102869a2159465a50e9
SHA1 hash:	4d66019729174dcc04f92b0016567e7112a760c1
MD5 hash:	379314570bf3b8a0eba61cc58079222a
humanhash:	failed-floor-december-avocado
File name:	379314570bf3b8a0eba61cc58079222a.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	2'644'776 bytes
First seen:	2022-03-22 15:13:06 UTC
Last seen:	2022-03-22 16:44:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7f202152ef7611b15765383169e656a1 (4 x RedLineStealer)
ssdeep	49152:UWZKOfmDaJi4etlVH24aKRRmHFA1K7JXXXNiNN4fQL8ed2cZ58yCPxOW+ulyBApy:UsKOf8SiLl50K3mlAUJnXNiNN4YdH58s
Threatray	2'827 similar samples on MalwareBazaar
TLSH	T13EC523AAA6B493F7E057533588D5E11AF2F1B0468B23929B53258B731E037E0AD7D313
File icon (PE):
dhash icon	6192a6a6a6a6c401 (17 x RedLineStealer, 11 x PythonStealer, 9 x DCRat)
Reporter	abuse_ch
Tags:	exe RedLineStealer signed

Code Signing Certificate

Organisation:	Google LLC
Issuer:	Google LLC
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-03-14T00:00:00Z
Valid to:	2024-03-14T00:00:00Z
Serial number:	111505a89f16dd26
Intelligence:	4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	dcc71c04432dc860dd824d5bd9af349aa49d073394be4a9ae9aabf6c50227b2b
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

abuse_ch

RedLineStealer C2:
62.204.41.199:30941

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
62.204.41.199:30941	https://threatfox.abuse.ch/ioc/439167/

Intelligence

File Origin

# of uploads :

# of downloads :

234

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

Setup_x32_x64.exe

Verdict:

Malicious activity

Analysis date:

2022-03-22 13:58:08 UTC

Tags:

evasion trojan rat redline socelars stealer loader opendir amadey danabot vidar ransomware stop

Link:

https://app.any.run/tasks/0d85380f-7dbf-4e32-95ef-712accab5bd0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/254747/

Detection(s):

SecuriteInfo.com.BAT.Starter.366.28795.10069.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Moving a file to the %temp% subdirectory

Creating a process from a recently created file

Replacing files

Enabling the 'hidden' option for files in the %temp% directory

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Searching for the window

Unauthorized injection to a recently created process

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/10429/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

keylogger overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/6239e7920cd58dbd92d75583/reports/488f8be1-4269-4519-9a88-139b08774488/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/961768

Signature

Connects to many ports of the same IP (likely port scanning)

Found malware configuration

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2022-03-22 15:14:19 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 27 (40.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qy6dunu7rq4nzqqvqftofqkrbnqq6657owtxqmh7xjrkb4kncmtq._file

Verdict:

malicious

RedLineStealer

381517605def58f63a5aabe969f824b399e16c952042d3d549bf4a276d433eb5

RedLineStealer

a866fa02bf6f9324d6f3713ed1533e4f0262a29a50ab0734e03fe6ed52df11fd

RedLineStealer

b50d346307ef27c92bf6e5fda61bf060e00ab50119b50facb34cad30747f7c8e

RedLineStealer

dac434ec87d2d83b5426f13247201e8d8826133fc445a4468f4fdc49b19eea2c

RedLineStealer

fc45aada4dd0fd54fea4854bd07276881f46b469cc248146d1772188a5704384

RedLineStealer

+ 2'817 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:5 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220322-smbyracehl/

Behaviour

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

RedLine

RedLine Payload

Malware Config

C2 Extraction:

62.204.41.199:30941

Unpacked files

SH256 hash:

863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327

MD5 hash:

379314570bf3b8a0eba61cc58079222a

SHA1 hash:

4d66019729174dcc04f92b0016567e7112a760c1

Link:

https://www.unpac.me/results/940f87a5-e3b3-4346-a8f2-f93631addb02/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.