MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8da7df7e936d65ddc4e41a63d4435f3a45733d3c4e84974b17490d07f1434baa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8da7df7e936d65ddc4e41a63d4435f3a45733d3c4e84974b17490d07f1434baa
SHA3-384 hash: fd05054a31a0e2592479b203bf5498f1df31a32e4fa87ae43344d1bd5c6cb01652a3c51e0870fa0fb0eef51949340338
SHA1 hash: ae11bd14271ccbe0c2098d90be8d55c3e6faba38
MD5 hash: 4d1a09cd606356af765542b8f651004b
humanhash: sodium-papa-carolina-april
File name:4d1a09cd606356af765542b8f651004b.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'759'920 bytes
First seen:2022-02-01 17:06:04 UTC
Last seen:2022-02-01 19:09:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 41304e4befbbd8a63ad6ec59f252160b (56 x RedLineStealer, 4 x RaccoonStealer, 2 x CoinMiner)
ssdeep 98304:5zT5foJBAM0Aeaumc9Z0HZsNGoihoRKZpUAOPLQSyxg9+:5zTWJSRAeauJ9ZcqNGoxRKmLQSyxgA
Threatray 1'125 similar samples on MalwareBazaar
TLSH T10C0633DC7B08BE2ED88497B00757A01D47E06249EF19D60E763A5E36196EFE2F01127E
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.128.107.55:9006

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.128.107.55:9006 https://threatfox.abuse.ch/ioc/373995/

Intelligence

File Origin
# of uploads :
2
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/229267/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Searching for the window
DNS request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61f968c1a0f6a794b330f3b6/reports/32c5d36f-e11e-4788-97f7-82f9e4d89938/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7de16f77-5740-4d6d-bf4e-9fc0f0391649
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/931885
Signature
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8da7df7e936d65ddc4e41a63d4435f3a45733d3c4e84974b17490d07f1434baa/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 17:07:16 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwt567utnvs53rhedjr5iq27hjcxgpj4j2cjosyxjegqp4kdjova._file
Verdict:
malicious
Similar samples:
056c064ef385bcc1cd430cb7b88e82f0566d1182c80503fe26f1fc9732fc42f5
RedLineStealer
06af78c89fc6b79696c14326d98a5d8ff14ae51b4303c308a77d980dbd731922
RedLineStealer
3ed3b03c36265ddffd8382859b7545cec6955331f85907018adc4bacde22e70e
RedLineStealer
87b1b6c23161d93aed2729e2fce32dc577793341e4755cdeaac41f8c50b76a56
RedLineStealer
977c68b28f92df1f9cb32d67323dc5c13ee2da192f8007dbf893338529bd88e2
RedLineStealer
aea2cbc32b7925ab28e619b8deb5c540ea8e61ad631b02e348be04b87f44627a
RedLineStealer
b4a3cafc8553c06b17131e6b3afb38971312a4d91ae3349d2d118bdfc3d8de94
RedLineStealer
bcec9d5bf1c3652cf5d200ff652c71c56cc17e59c99b320f7ae77c1e4f5b15db
RedLineStealer
ca05bdeff05876d189e870c1b7af2bf4bd098214506905655ced4f73efe8560b
RedLineStealer
+ 1'115 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220201-vmeezshgfn/
Unpacked files
SH256 hash:
1cbf29f02d2d54c524cb3d9ad09d8827f14f47976458ad9b7d7dde4012667a1c
MD5 hash:
6642af9505a6243915d78a7c44ccdedd
SHA1 hash:
604e0de43da5963237c534fc63f92ef65c4d8ce3
Link:
https://www.unpac.me/results/4a99d83f-b703-45c0-a8f2-0aaa79125cd3/
SH256 hash:
8da7df7e936d65ddc4e41a63d4435f3a45733d3c4e84974b17490d07f1434baa
MD5 hash:
4d1a09cd606356af765542b8f651004b
SHA1 hash:
ae11bd14271ccbe0c2098d90be8d55c3e6faba38
Link:
https://www.unpac.me/results/4a99d83f-b703-45c0-a8f2-0aaa79125cd3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8da7df7e936d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8da7df7e936d65ddc4e41a63d4435f3a45733d3c4e84974b17490d07f1434baa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8da7df7e936d65ddc4e41a63d4435f3a45733d3c4e84974b17490d07f1434baa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2021558/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/229267/

Comments