MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 865fc17286ce58e28350c60fd7bb6ae82187c4af18f04afa9faa31ccaee3e1d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 865fc17286ce58e28350c60fd7bb6ae82187c4af18f04afa9faa31ccaee3e1d2
SHA3-384 hash: 6ade0fb1a3b4b6b79c9131e2c3a7afbef15e5e18dbf2b76aa2e91631d9ebc9cbca3e320cf55cd4b76aa6317adb3b3e85
SHA1 hash: c9270924c34a8b87adcdc8802a02da11affa3e34
MD5 hash: a346a9f0523401aba9b461dd5e88857f
humanhash: neptune-white-muppet-queen
File name:a346a9f0523401aba9b461dd5e88857f.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:387'072 bytes
First seen:2021-05-15 02:21:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash befd07d1e26e07628c5eb719b38d2eef (1 x RedLineStealer)
ssdeep 6144:02Fd0TFf9fwTMw9F7fjR0Jbhe7ZIjG67shlEg33kQYP/8K9NM91CbgARs:02f0d9fOFfjR0RQ7ZIjGBUQYP/emb6
Threatray 551 similar samples on MalwareBazaar
TLSH B884BE2136E1C032E1A326758566C7B54EBFB43227755ACF7BD40ABC1F246D1AA3630B
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
52.6.206.192:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
52.6.206.192:80 https://threatfox.abuse.ch/ioc/42660/

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a346a9f0523401aba9b461dd5e88857f.exe
Verdict:
No threats detected
Analysis date:
2021-05-15 02:22:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39eb27eb-1373-4ebd-85c7-b73b2497589f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/157260/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP POST request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/782575
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/865fc17286ce58e28350c60fd7bb6ae82187c4af18f04afa9faa31ccaee3e1d2/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-05-12 07:28:00 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qzp4c4ugzzmofa2qyyh5po3k5aqyprfpddyev6u7viy4zlxd4hja._file
Verdict:
malicious
Similar samples:
20cc86df6047d6350fb5ebc5a1aac365c6c0ca69bb6c6c0e1e3415010d0779b9
RedLineStealer
2e492cb7c8adba1e0e44b44c212802c8e891f0300d93060691e39f4f986da044
RedLineStealer
4c8d1a1d118384df23575d4421f573f9b97d984b295083b329a8ee08709dcfce
RedLineStealer
7b9bd29f5c0787b2937b34493ca5a7128d476dc9f4257643f1fd47d48399eafa
RedLineStealer
9c4589b45940c81fcc8722fa0f96f4b583995df1324a327eefbc276448ea4725
RedLineStealer
a5c463db805e356cb6e73e5676b397eab265e061c6797e27b626b8b4aee892a3
RedLineStealer
a99edbeb0833d7875fdfdd0c969130bc3c793d24a55ce3d20064db158c23537b
RedLineStealer
e9da1da3a4fb2050b9b17f5dbb1dd5f334f22637fc8186052d152cc631839f9b
RedLineStealer
f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa
RedLineStealer
f3ec960fde547dac872a3fe8ee59c3beb063457673fcf50480e20c886c7f17fa
RedLineStealer
+ 541 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:pub11-1 infostealer
Link:
https://tria.ge/reports/210515-m45stwmg9j/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine Payload
Malware Config
C2 Extraction:
shapkishop.store:80
razorless-shaving.store:80
fugicarfc8.store:80
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/865fc17286ce58e28350c60fd7bb6ae82187c4af18f04afa9faa31ccaee3e1d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/157260/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-15 03:00:30 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0003.002] Communication Micro-objective::Connect Pipe::Interprocess Communication
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0046] File System Micro-objective::Create Directory
4) [C0049] File System Micro-objective::Get File Attributes
5) [C0051] File System Micro-objective::Read File
6) [C0050] File System Micro-objective::Set File Attributes
7) [C0052] File System Micro-objective::Writes File
8) [C0033] Operating System Micro-objective::Console
9) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
10) [C0040] Process Micro-objective::Allocate Thread Local Storage
11) [C0041] Process Micro-objective::Set Thread Local Storage Value
12) [C0018] Process Micro-objective::Terminate Process