MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7
SHA3-384 hash: 23e111708008b06fc10099c01c3d87ca1622a98ea72dcae2566e2dc532064422f235ebeb923315ea87ca0d67240531bd
SHA1 hash: 54ca41da50940b1b529bb2a1ed54de1bd9f2021a
MD5 hash: b15e4f5305001f865f0527da9152248a
humanhash: video-lactose-five-spaghetti
File name:b15e4f5305001f865f0527da9152248a.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:396'288 bytes
First seen:2022-05-24 02:56:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 28bd666374957ad640bfcdff27cdedf7 (2 x RedLineStealer)
ssdeep 6144:abtcA1o8axNIaMXmlCBL932NPPW8yWO+AlDEzu2y85Bf+:abvOx/ILXmw93l8dTYe55N+
Threatray 3'292 similar samples on MalwareBazaar
TLSH T12E84C004FAA0C035F5BB02F4457A9769B52D7EB16B2051CF63D42AEE9A396D1EC3130B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon ccb6b3f9e9f2b3da (2 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.225:15304

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.106.191.225:15304 https://threatfox.abuse.ch/ioc/628973/

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
b15e4f5305001f865f0527da9152248a.exe
Verdict:
Malicious activity
Analysis date:
2022-05-24 03:10:55 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/be2fcf91-d7c2-459a-a99a-c2486530ed06

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/273917/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19771/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/628c49960be8a16da4e88a2b/reports/409b880b-3045-4c72-8388-f0db86eed3a2/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efa967da-661e-45f9-838f-47931b42b307
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1000336
Signature
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7/
Threat name:
Win32.Trojan.Vidar
Create hunting rule
Status:
Malicious
First seen:
2022-05-24 02:57:06 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ryhpz5ciwvs74l7cjbapzxqmt5chaos5h2kwhxbvz5lksnm6zg3q._file
Verdict:
malicious
Similar samples:
40ba87394996c8595a31da998cc0b88033ea8f7f988f769bc55a354a13fcd6f0
RedLineStealer
423603734e03a0601620dfa8522bbddfc14de5418da253167f46f3a14cca4979
RedLineStealer
42a39eb0eff9dccc54ca3d2d555709ec5a7979e8e3f0dbfd3afd2d472fdb814c
RedLineStealer
45b1fb24613d29274f7f4ea10d40b89fbae678e619fa705084882c3c58cd038f
RedLineStealer
85020899a469f86115d50034cc3f82a4c29960b1f18c467b496ad6c8a0eacd7f
RedLineStealer
8fe90f9a21cf8dc1a12a65981181a379ed9fff48b212a77c4897cbfaee7cac7b
RedLineStealer
bcd801ffcc3e97238eded74a880f756ad1ce240c8b4fb94ed2e830db58d0d414
RedLineStealer
+ 3'282 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220524-dfkvradcc3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
193.106.191.225:15304
Unpacked files
SH256 hash:
77557f0d6442cb616dc088b8bead0012fdcbf684a81db8d38dccec17060e5b62
MD5 hash:
05c7efae5e272b418345312fce100d23
SHA1 hash:
d629fbf0d3edb8f04d49362d24c58f86f2e2d694
Link:
https://www.unpac.me/results/81589fef-60f4-4817-bb0f-c2efc499a4e4/
SH256 hash:
69ea50611f54ba14e2f62069c3458400e120b37848c5a9b0baf39818a17ac2e8
MD5 hash:
4d3e8d231ce1906045377bdf2d647d08
SHA1 hash:
82e947b615f889938dc6524537729d6e9ce4fa77
Link:
https://www.unpac.me/results/81589fef-60f4-4817-bb0f-c2efc499a4e4/
SH256 hash:
80fd16ce08e754f5efbefc415271a0ab172e6101575d331922e17519c4eb7ea2
MD5 hash:
41a65e479ae0d19666369fb4df32c234
SHA1 hash:
7a2f4e680c46bf94d5e84d3d7d3e14d39d5d3158
Link:
https://www.unpac.me/results/81589fef-60f4-4817-bb0f-c2efc499a4e4/
SH256 hash:
8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7
MD5 hash:
b15e4f5305001f865f0527da9152248a
SHA1 hash:
54ca41da50940b1b529bb2a1ed54de1bd9f2021a
Link:
https://www.unpac.me/results/81589fef-60f4-4817-bb0f-c2efc499a4e4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8e0efcf448b565fe2fe24840fcde0c9f44703a5d3e9563dc35cf56a9359ec9b7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2164186/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2183649/
  
URLhaus
https://urlhaus.abuse.ch/url/2151581/
Cape
Cape
https://www.capesandbox.com/analysis/273917/

Comments