MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b6808765ac89ab9c790d28399049ea162c15b761328e71b671596b3a8bc6ea5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments 1

SHA256 hash:	8b6808765ac89ab9c790d28399049ea162c15b761328e71b671596b3a8bc6ea5
SHA3-384 hash:	788b1829d7246745c48518993289c7acf78fcb60948643d853bf9dc8884f8e60e5251bfe8058108954a8fe5b0b47e527
SHA1 hash:	4a570933842d0db3b40cb7414925e2c506e61d0d
MD5 hash:	67a047f8874a44de31b0dd8cd22d7af0
humanhash:	connecticut-one-floor-mexico
File name:	67a047f8874a44de31b0dd8cd22d7af0
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	377'344 bytes
First seen:	2022-05-07 21:15:54 UTC
Last seen:	2022-05-07 21:33:01 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c2f34b03efba3580b2f36c10f3cf4dcc (9 x RedLineStealer)
ssdeep	6144:xyFds+HbQgYTM/HgiWeVXizKgnM86XWSizR+tm/qJzjeKZOo1kezbbo:ovRb/qM/HgivXKM86GSmRbqJ3egee
Threatray	4'595 similar samples on MalwareBazaar
TLSH	T18884CF10BA60E035F1F726F4497AC778B93D7EA19B2451CB62D52AEE56346E0EC3130B
TrID	39.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 29.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	badacabecee6baa6 (95 x Stop, 87 x RedLineStealer, 62 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.45.192.228:81	https://threatfox.abuse.ch/ioc/548657/

Intelligence

File Origin

# of uploads :

# of downloads :

485

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

67a047f8874a44de31b0dd8cd22d7af0

Verdict:

Malicious activity

Analysis date:

2022-05-07 21:17:37 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/97229b6a-9c8f-42e4-b5e8-4a8caf109fd6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/269275/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.5364.20949.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Query of malicious DNS domain

Sending a TCP request to an infection source

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/16652/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6276e195bd5c76586e1cee90/reports/c3bd65c2-4ae3-4bb3-9923-188443c269d1/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ac7f3a3f-4613-46f9-8ac3-6e4bb71d38b6

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/989555

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b6808765ac89ab9c790d28399049ea162c15b761328e71b671596b3a8bc6ea5/

Threat name:

Win32.Trojan.Krypter

Status:

Malicious

First seen:

2022-05-07 21:16:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rnuaq5s2zcnltr4q2kbzsbe6ufrmcw3wcmuoog3hcwllhkf4n2sq._file

Verdict:

malicious

RedLineStealer

969226af05d45d1731c6be04865a8846890c463dae2a66b7a63030a6442cc8e3

RedLineStealer

afac7896cf21983233c533eeaec870610856969d98218b0ffdfa11c6f57a8420

RedLineStealer

b79037b76c1503954797d791368597aca92908cb9ee809b2e2122ed8a04531e1

RedLineStealer

e25f30195621d1fda7b9981355a45aea95381ca10f456e478bfbfab84e6ce946

RedLineStealer

e2e7294a6fee9ef6372897f3bebffb0d17bc31b9cf8c663181e192a608057061

RedLineStealer

+ 4'585 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220507-z4fftshegr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Unpacked files

SH256 hash:

6c24edc3b968d70be591ab2b7e321afb103a86ebc33dc7984e103fac22cfa629

MD5 hash:

9d1be779da4057371614ef92c4bb7b3a

SHA1 hash:

e461a6e37d63176377e74bff4d7be6acc69ca888

Link:

https://www.unpac.me/results/561374ba-e6c9-43b1-b45a-d43c7a26f90a/

SH256 hash:

79f2396cbd79b73cd6899e8c6950885b5b1f24762589c451adebfec797bb473e

MD5 hash:

a35857ee015be0a2298759010ac63db2

SHA1 hash:

d4fe87585c24ac05778cfbe9cb1a5cb7bfc9dd5c

Link:

https://www.unpac.me/results/561374ba-e6c9-43b1-b45a-d43c7a26f90a/

SH256 hash:

9486bd00d8fb83c1fff888c6c9e9e091f115ae50a78deef8893641280d451e2b

MD5 hash:

6d236659980c4328c23803cacbb29160

SHA1 hash:

67be0779627c32c9c1582b055faf23edc8df54e2

Link:

https://www.unpac.me/results/561374ba-e6c9-43b1-b45a-d43c7a26f90a/

SH256 hash:

8b6808765ac89ab9c790d28399049ea162c15b761328e71b671596b3a8bc6ea5

MD5 hash:

67a047f8874a44de31b0dd8cd22d7af0

SHA1 hash:

4a570933842d0db3b40cb7414925e2c506e61d0d

Link:

https://www.unpac.me/results/561374ba-e6c9-43b1-b45a-d43c7a26f90a/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8b6808765ac8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8b6808765ac89ab9c790d28399049ea162c15b761328e71b671596b3a8bc6ea5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.