MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 900340be52f1ec06c16e249327f413454ffb4e5a0df9caf880dee1236f18f8c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 900340be52f1ec06c16e249327f413454ffb4e5a0df9caf880dee1236f18f8c5
SHA3-384 hash: 1c7bbe79266480ad7a407ee07805abd1b234abfee5e0844ecac044be788ae3f22449e755ce6e4b4637d49f3d82115e9d
SHA1 hash: fbd3dc402af9ce63642c5d22ea808ef6afba2fa5
MD5 hash: 9e904babe60c12759ef6e3a327897c5c
humanhash: ceiling-nitrogen-iowa-summer
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:244'224 bytes
First seen:2022-11-16 20:54:05 UTC
Last seen:2022-11-16 22:45:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fa8640a79704fef7deaa607934e0abc9 (11 x RedLineStealer)
ssdeep 3072:XDb52lPWNC981AP+RLizsQhfVIhteQLCymz0z1eyt+Bxv8pDkMqO1fVga0Cst:XD4POLLMNg9uz0z1efxEVk1GVyt
Threatray 1'399 similar samples on MalwareBazaar
TLSH T1EE349C17B973A039CC06D0FE08D5D2A1A3AC0B326B95D0C276CF0B6B4E715EC59B96E5
TrID 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.0% (.SCR) Windows screen saver (13097/50/3)
13.6% (.EXE) Win64 Executable (generic) (10523/12/4)
8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.110.203.101/puta/softwinx86.exe

Intelligence

File Origin
# of uploads :
24
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-16 20:54:41 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/1b1d7785-a6da-45ae-a037-3edfc4ec6be6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/335063/
Detection(s):
SecuriteInfo.com.Trojan.PWS.StealerNET.125.19988.18905.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a window
Connecting to a non-recommended domain
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63754e276fda73cab64e1d8c/reports/8987d6fa-39a4-4e9f-b31a-7850e4ecdc9d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/44cd8a7a-d368-4680-9911-210e24199c72
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1115295
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/900340be52f1ec06c16e249327f413454ffb4e5a0df9caf880dee1236f18f8c5/
Threat name:
Win32.Backdoor.Convagent
Create hunting rule
Status:
Malicious
First seen:
2022-11-16 20:55:08 UTC
File Type:
PE (Exe)
AV detection:
17 of 39 (43.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sabubpss6hwanqloesjsp5ativh7wts2bx44v6ea33qsg3yy7dcq._file
Verdict:
malicious
Similar samples:
1c31d1c204f83157f5d5d139ff0d6ddcdc59d971c344f7a0b59306b862464db1
RedLineStealer
323a424031828737354285bc660d6333754fe9ff077d1214129d598024de8c14
RedLineStealer
548e9a18cd3b0202cc2542091ec35d5b72b7966865e9472025b6485bd1dfc7a9
RedLineStealer
5bb88e08c1a08871a99adce0f3ae6f34c855c460f0ac77437cb4c73235824ab7
RedLineStealer
b629a616c8b459f587ecfa6507efa841df3984fa0d8525cbdfbec4ba7e66aeac
RedLineStealer
cdcb1cbf81cb108f1bba4e358c632097582efd36f7b7979c553ff1e83b833760
RedLineStealer
e6d302a4849a5b211fb5351a4ed83bb2c337ad21bc78dbc7fe64482eea22edd6
RedLineStealer
ef5ebed758551ce1266e4f30ca6010e151f6c5e6f1e0748949dd09d0b42716e1
RedLineStealer
+ 1'389 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@madboyza infostealer spyware
Link:
https://tria.ge/reports/221116-zqe8xagh41/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
RedLine
RedLine payload
Malware Config
C2 Extraction:
193.106.191.138:32796
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4d21f293-a366-4c6a-bb39-234f61dada08
Unpacked files
SH256 hash:
4d13d06d716a80fce5a93547c34cca425473f462ff00a79f7ae1b8ab7db6a5b0
MD5 hash:
7d0bf0ede21d398b4a65e556a1edc433
SHA1 hash:
9174da73bfe26cd61eaad6ae078f11300891db2f
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/8e380a47-e43b-4213-b650-cd82d4ccd20a/
Parent samples :
323a424031828737354285bc660d6333754fe9ff077d1214129d598024de8c14
548e9a18cd3b0202cc2542091ec35d5b72b7966865e9472025b6485bd1dfc7a9
b629a616c8b459f587ecfa6507efa841df3984fa0d8525cbdfbec4ba7e66aeac
900340be52f1ec06c16e249327f413454ffb4e5a0df9caf880dee1236f18f8c5
54f626a76890bd100e866fefe7daa21b253760d180dd122e99e5cf86c345c39b
9d9d2f25390f2efedd7c6744cb6537857775dfc6b3f72882f664121501e8371f
f02358a4229085fd7b5da0b923b6dc67244099c1da2acf2eb1f696b905b2b7b6
a3db3a64098426a931442a40b114d188f09b4895c54dd5e57e23356c14d85e0d
9ef2d217d94bbd09b8a51941218fb62465801107557be2cbd376263ee27f4082
7e0a00f8d6ce93d96f887fc2372e24117e2b5c425c415842e7b4e8051ac03eae
a5833b3b40cdc6def671953c3a8075b3864e068e1d9b3dde5256380dfa6315bd
b57a603bb9ffb091e81dbad33fab9d7840b56ce0f2584b3168f79e5909dad331
efcc04f8e872488d642bd288dfac2f078d611de316770fde47d1dc9a0e76aa84
9158b433505974c8a6db1f168c19604f60e46ed79f6981d8dbd42d49c1078a98
4709fd98726279f1671ff8486d4dbaa7d475972599d50740ca606248d13f904b
9746de42e598888d36496f78c8cdb7145db4fa524ab4fa924ce7e2d19480731c
2f067abf432e132947018cec390ed0a6a552a32f77bdad852d1adb75266c2e58
d99b7f70d1451c0ac595420b2fe983ecda625c47575ee4a24e786dc440626a55
55b090bf222bcc1520d72defa7cb7f93b78909fc77c261151a25a2970d0a5cbb
328d1ecec81fbe3bb0d9a76226fd8d7f555c0dc6a4107a05428fe27c2869fbbd
b50afa7b5584104dd0f93b85a448feb12c14a7f10b256071e47e90603b8b6280
415429a768dcd1d4a24bd7781f16f7814aabd7f6aeb6a5fa312218bede547160
7ca931c4fdd7c8f42528877186dc718896508c98d2cb7346a956af2f7ad26a3f
b8eae4aa0ba655621dc231943e732fa0d5399a4a255b7b6652d06275d3d2f4ef
e9cbe3213f2d0d3fbe2d69e387de540abb36946b92a6aaf62b9d8c3f702dd947
a444b1d644cef528fcdd3cf1ab763e2aaadf794b64b1eeb960679766bae92c75
762d455a078d13b6b89bcce46db81dd3e755055bf499e856911fe542c7fd8d83
b3e14be741aad18d69038dfff3faef9f99a0974df8d7032fdab383a30cadbedd
00b6ed886450dcf28adc280a58a6e00c3176fd14c0fe216d95fd6d18b9471556
200bb7cb4ff972ed61d1f4d6b2893dc611e8aa1005bbba8b28d1b7e56f6677f4
1c1b1d19e8811b999d628b5af81dd2bc87e8da7d9339b97af4511346b4d6ea3b
4268a707cdc42b0b2543831ff435c280efbab5dc7424bb519bc9a1f3ffaca9a0
22932ac12c61f7ade37d16a82ad02d08259263020f4a465d15f2830fa03df12b
55bdc0f9d7483995f5ec82f3bb8d528815cf80cdc1a35dabb674e4abdf25ed1c
74d80d553297cc9c8d4ef2429d304d22df0f704010c897843e09bd80354c2646
SH256 hash:
900340be52f1ec06c16e249327f413454ffb4e5a0df9caf880dee1236f18f8c5
MD5 hash:
9e904babe60c12759ef6e3a327897c5c
SHA1 hash:
fbd3dc402af9ce63642c5d22ea808ef6afba2fa5
Link:
https://www.unpac.me/results/8e380a47-e43b-4213-b650-cd82d4ccd20a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/900340be52f1ec06c16e249327f413454ffb4e5a0df9caf880dee1236f18f8c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/335063/
  
URLhaus
https://urlhaus.abuse.ch/url/2403396/

Comments