MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
SHA3-384 hash: b15ce9c7912d5cb440267e2c777e43272ff9a9f70a727729443ec40bedad45376ed5165231540914ca9c49a7ad21fe3b
SHA1 hash: 69b810c1d57a503e9198fbfe5598cee528d298fd
MD5 hash: efc8f7aa1131a8646ef1414ff55f81ac
humanhash: don-xray-august-montana
File name:efc8f7aa1131a8646ef1414ff55f81ac
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'698'359 bytes
First seen:2023-12-16 02:52:26 UTC
Last seen:2023-12-16 05:23:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash efe29a6c50b79427ae937c4473543cdc (4 x RedLineStealer)
ssdeep 24576:jGNRBMjxC4veL7cm1DJQsbnrDMlA1Xpw6aOiG8TIJS4FfCG:0BMjFveLjJJRn8OZGOiG8TIz6G
TLSH T13375F191395D0C37E37B0673B27A402BB57E0EAEA32AD59B413863E9C9E052DDC1257C
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
292
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/467861/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.18390.23818.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/657d110eb855eb3693de5eee/reports/e1cd0c17-8b9f-44e6-93bb-2c248819c7c3/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/661a7392-2747-4fd6-90c8-3df0e3417048
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1363180
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1363180 Sample: K8ksAG5FOl.exe Startdate: 16/12/2023 Architecture: WINDOWS Score: 100 32 Snort IDS alert for network traffic 2->32 34 Multi AV Scanner detection for domain / URL 2->34 36 Found malware configuration 2->36 38 9 other signatures 2->38 7 K8ksAG5FOl.exe 5 2->7         started        process3 file4 24 C:\Users\user\AppData\Roaming\...\File2.exe, PE32 7->24 dropped 26 C:\Users\user\AppData\Roaming\...\File1.exe, PE32 7->26 dropped 10 File2.exe 8 4 7->10         started        14 File1.exe 4 7->14         started        16 cmd.exe 1 7->16         started        18 conhost.exe 7->18         started        process5 dnsIp6 28 176.123.7.190, 32927, 49729 ALEXHOSTMD Moldova Republic of 10->28 40 Antivirus detection for dropped file 10->40 42 Multi AV Scanner detection for dropped file 10->42 44 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->44 46 Tries to harvest and steal browser information (history, passwords, etc) 10->46 30 176.123.10.211, 47430, 49730 ALEXHOSTMD Moldova Republic of 14->30 48 Machine Learning detection for dropped file 14->48 50 Found many strings related to Crypto-Wallets (likely being stolen) 14->50 52 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->52 20 conhost.exe 16->20         started        22 choice.exe 1 16->22         started        signatures7 process8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-12-15 11:47:46 UTC
File Type:
PE (Exe)
AV detection:
20 of 37 (54.05%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxrvfqn4uddrfrr7jstpzrxxexy47o2gfu4uresy5kchq6d3wzuq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231216-ddal1aabek/
Unpacked files
SH256 hash:
0c3ba1ed7210694ecbac0028c6ecc8508e80667ef336c321ba3e1ade510371b6
MD5 hash:
7d4a62d54c733ef9752232e3334c2eee
SHA1 hash:
db0520a08226dc0ab4fd879fd6690c32c816a927
Detections:
redline
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/427028a6-529b-4936-868a-c5c3ec86ab1d/
Parent samples :
2f94e4ce7f8ee0d584b776988ac0dd80df820f5a44d866271efce73c6ad84fc6
861cfaafee3a7a3a67bf5d707b193c7396811c8c7c22136886e2bb0513e4fd66
28a2cb032410d19178b1635a246f1306644ac10838f445495b9e57fdf3718e3a
e347d2c37800e83e391725e58e82a1901d3b91c04f4707bc340499bf2e6a6fe1
7b3a28bfe1eb241dd539336313198a6684bcbef1905349b8b0859de555bdf3dc
8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d
4e6015f1e7c8790a2907de407d2ea9e14ccc04e925c81607fb815bd73c372389
854929dccfca0bc24198bb737a81a8d74b2bc924049167b8ed6ad8e96a75610b
0182e73c39240c0e660bbdd4262209f08d767562d4794b7ed5e36a4d4f36b409
b08a80b3d8ed960304fd66086b3c2cf13745118e04d6db99f9b0ff68b869b4cf
0c3419ff8ddebff25027285ff876f30569e7915b993930411b230cfbf3e52214
0f2f61669d3bc852e0defe69777a70627ae072b167425a64f4c88ac9ca84389c
3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
51f914de76eac9e6bce5b2d3efb1d00a240097e71f3f042303b16917702f64ed
e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494
672f24842aeb72d7bd8d64e78aaba5f3a953409ce21cfe97d3a80e7ef67f232a
2f25790b3368b6afd35007dfe873e90a288cfce9d19758756b71fa6952a675f2
SH256 hash:
7d47c8005b810d93d72c71260cdece50477693473666e5e919f4e6d967718134
MD5 hash:
382931c9ca4c662cee9809dc1cbc0add
SHA1 hash:
d46d8828e2476b547eae069e9a41e7e9b871f088
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/427028a6-529b-4936-868a-c5c3ec86ab1d/
Parent samples :
7b3a28bfe1eb241dd539336313198a6684bcbef1905349b8b0859de555bdf3dc
320d7be57b8e56249ba0892fc78bdf7fbae8d54fc8709bc86c7cf98f56189f0e
8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d
SH256 hash:
2b64b92de448dec9aab199f9f78eac04bed5f84b9b0c9bdb933a21dc62f42cb6
MD5 hash:
8848e20af2e0f3f29485bd63ee16c877
SHA1 hash:
92ce474025880e415dcb27872a102278dba2eae1
Detections:
redline
Create hunting rule
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/427028a6-529b-4936-868a-c5c3ec86ab1d/
Parent samples :
7b3a28bfe1eb241dd539336313198a6684bcbef1905349b8b0859de555bdf3dc
8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d
SH256 hash:
88c05eff7445f47017b6d0714a83865457a63f830fe28950a24d59b720ca9275
MD5 hash:
c4c8b451d8dd8ffaf54a61236c745430
SHA1 hash:
4758cd543678082abd8b36d8daa5df2fb91e9197
Detections:
MALWARE_Win_RedLine
Create hunting rule
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/427028a6-529b-4936-868a-c5c3ec86ab1d/
Parent samples :
7b3a28bfe1eb241dd539336313198a6684bcbef1905349b8b0859de555bdf3dc
8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
2b82e968c7dc0b4726acb9ead06092a059fbf34e9068532ad1151c479e5b331d
SH256 hash:
8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669
MD5 hash:
efc8f7aa1131a8646ef1414ff55f81ac
SHA1 hash:
69b810c1d57a503e9198fbfe5598cee528d298fd
Link:
https://www.unpac.me/results/427028a6-529b-4936-868a-c5c3ec86ab1d/
Malware family:
RedLine.D
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8de352c1bca0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8de352c1bca0c712c63f4ca6fcc6f725f1cfbb462d39489258ea8478787bb669

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2741309/
Cape
Cape
https://www.capesandbox.com/analysis/467861/

Comments


Avatar
zbet commented on 2023-12-16 02:52:27 UTC

url : hxxp://193.42.33.65/razdva.exe