MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc
SHA3-384 hash: 69d1dc8e148117c6bf75e314be5f55e9e806be8f276b6fe11dc79a3accc6f5032ba60ccf9f87973607c312d2805cac6f
SHA1 hash: 5d0047e71c5f3d2a8cbfbac848ac977a48f4158e
MD5 hash: 992efd29479acb4bd68434263df3679e
humanhash: july-jig-bakerloo-earth
File name:4TEQ.bin
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'374'528 bytes
First seen:2023-07-19 02:54:45 UTC
Last seen:2023-07-19 02:58:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 372e4e4870a9f350530e0a006218a951 (3 x RedLineStealer)
ssdeep 24576:43rV0wJVBLU8IOSUReWB/EUNDlOHl907GzDT1cZnIYFhv7i6XKeLKlQTJdl6EJmW:4lVBY87SUReWyUGI70TuZnv7XuidlvJ/
Threatray 1'539 similar samples on MalwareBazaar
TLSH T14455AE006454C715D42CF8729473DF899A98A63C2B3FB5608BA41BE2BD3FF5C826D362
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter JAMESWT_WT
Tags:exe FruitMiX RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
257
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://storedechuladas.com/wp-content/download/File_pass1234.7z
Verdict:
Malicious activity
Analysis date:
2023-07-18 07:26:55 UTC
Tags:
privateloader evasion opendir risepro stealer payload fabookie rat redline loader povertystealer amadey trojan gcleaner smoke botnet miner ransomware stop tofsee arkei vidar
Link:
https://app.any.run/tasks/ff200dc8-95d9-4ee8-afad-1ff9a9e83642

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/424397/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.3346.4571.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware masquerade overlay packed
Link:
https://www.filescan.io/uploads/64b75088fd9e198dc115f11d/reports/29c10099-ab6c-4841-9b9b-2915cee9a41e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2691241f-92c4-4a84-a088-c14d72590990
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1275576
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-07-19 02:50:37 UTC
File Type:
PE (Exe)
AV detection:
17 of 25 (68.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q7oynqeookkrqg3czedewb2xy6h4nbkgjsx5xi43ykjlmsgad3oa._file
Verdict:
malicious
Similar samples:
4464eac337f79d47d791c202d2a12935d7f6df0e9e6cb7628368f48945eaf8dd
RedLineStealer
5b29f79768ee0d8a152cb1d3d43a46391760f8af164fd05487a901de652ed8ca
RedLineStealer
5bd627de8e44980f100d382bd310fe3db2c2a61ab27c15fc09a7ea97c17b51b4
RedLineStealer
62686b0e5ca03522eae3bc58a8dc7e32673a59f1776a6edb67188d5828090e44
RedLineStealer
8eb73baffb38cae7fb0f1589222c639fc2c17880c18ecb848cd5059915b232f0
RedLineStealer
9b8c90e5119853c1a09f31a773e2d4af151c78174c78b14eac6377c7562f7735
RedLineStealer
aa46c78978d744edae1170acdc7a518ff42bb02eba66a52724d46226b15c4633
RedLineStealer
b96d28c0c43a8bc8c124dfbd69b03e2ea83c698024a7bd4e3770a2465e425c44
RedLineStealer
e6dc45b261c3eb6b27fc2258f74d69bad8cf31059f051636f36d7352bf6b0c98
RedLineStealer
f432f9cb89ee9ea1704bf3d33c85f19483a4258f4277b126201930dff9d119f5
RedLineStealer
+ 1'529 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:1006 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230719-def56sga8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
176.123.9.142:14845
Unpacked files
SH256 hash:
bc35824b3672773f3cacdf800ada142f0a49b888d45f87b0b4dffd9ffec9eea6
MD5 hash:
ea3780150783be646b96bbc36ba6cccc
SHA1 hash:
ee8750122ba4bf9b808504bf2b2b501b024c7abd
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/03ff130a-bc87-4d87-99f5-28fd430b9572/
Parent samples :
f3e834ab464b6d385012e087d0da0821d01103dccebdd2f0d96412f49c66837f
a860b89f86e920dca7e78c4b0b025ec3db73a72a8fdfa19dd841ae4039648e09
67b88597352598d94af1e7cdfaf07007e87dc6891a9564518c664afcbc1eb20f
1cc9a5335e90cd21fb7cc7f39c7d5e13c55306b875bb9603d1a3479dba3e4d19
775f34d6140bb1a2cf210d422230e511d0af52c7d5c96ff8198d74387f2b3815
d6b5e39bcbf51127c1f73ca3b28d4d3d2520614bf7ccfad2383132826010c435
0f56b599e1d6542ca624e7128e743c9d06c5e455ad7ffff8ad97e0ff8cc9ddd1
47677d1b0a154564df5f5fbf5f16e8c2dd493dc3c927ab44afaf971c0120793d
87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc
59730f51413f0824b007ce6def5e65edd9fba468554a5c338d96ac8215ff2254
SH256 hash:
516a0076eff0ca6b78047765cf7ec3e88cee6406ef6dc8dedf7c8d1a1d882a8a
MD5 hash:
c1d446de68f605b3d7f32be20fa96b74
SHA1 hash:
e61576a294f43e141888558a8893c165a4464697
Link:
https://www.unpac.me/results/03ff130a-bc87-4d87-99f5-28fd430b9572/
SH256 hash:
87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc
MD5 hash:
992efd29479acb4bd68434263df3679e
SHA1 hash:
5d0047e71c5f3d2a8cbfbac848ac977a48f4158e
Link:
https://www.unpac.me/results/03ff130a-bc87-4d87-99f5-28fd430b9572/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/87dd86c08e72/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87dd86c08e7295181b62c9064b0757c78fc685464cafdba39bc292b648c01edc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent
Create hunting rule
Author:ditekSHen
Description:Detects executables containing base64 encoded User Agent
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/424397/

Comments