MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 2 File information Comments

SHA256 hash:	9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5
SHA3-384 hash:	d5f489c81000e000bcd851317800ba4d7db2ed64d877be14d027e4c3247185fd1b5df9d3fa463d4cd94450984e4f8d9c
SHA1 hash:	90cf05748fc1cfdf3b054ac3ad09cd697434a374
MD5 hash:	cff029aeed9b539f3a6ed65ca0a08795
humanhash:	magnesium-robin-march-july
File name:	cff029aeed9b539f3a6ed65ca0a08795.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	359'424 bytes
First seen:	2022-10-25 03:31:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a2a488c1ba888cbce9fc8f3bca83fd16 (9 x RedLineStealer, 7 x ArkeiStealer, 4 x Tofsee)
ssdeep	6144:V2wsvNLaSPecFQgYemFL4MCSYPSppsf2qo/M7bZ99qvApAdHXpjM:V2wsvN9PDQglmF4+USpKf2qo/CDgvwAv
Threatray	9'363 similar samples on MalwareBazaar
TLSH	T16674E02236C0C471D67752718D61C6746BAFB8741A3A97DB7BC812AE8F302D2DA3534B
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9a9acadecee6eaee (98 x Smoke Loader, 33 x RedLineStealer, 24 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
79.137.199.60:4691

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
79.137.199.60:4691	https://threatfox.abuse.ch/ioc/926486/

Intelligence

File Origin

# of uploads :

# of downloads :

239

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

cff029aeed9b539f3a6ed65ca0a08795.exe

Verdict:

Malicious activity

Analysis date:

2022-10-25 03:32:00 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/4d6f085b-eb03-494a-876a-409cf72fc7bb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/323754/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.16498.31501.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/99745ae1-2771-4e28-8b1d-f294572a9281

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1097188

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2022-10-25 04:12:51 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sbkehhzfmo3grjh42hrlairqojbr7sifsr5xzadmynoisuxfcw2q._file

Verdict:

malicious

RedLineStealer

1fb2cc77dcb40479b8c6c583024e1d84a4308087049152ff32bf71f18f436727

RedLineStealer

23ecd958cf9643c52e2951f734a39c7b250d7f185840955e62169b5b326d9439

RedLineStealer

7f57547f6b8deecb741ab99ee18acad723df2e2765c5523a30738dd8019b311d

RedLineStealer

9ccd52333f7ce04c90ae7c8234dbb77ce98a50e2c1e4837eab4f2d6bd60adffa

RedLineStealer

d8d42b8dfcaa679436d63aa693498c7586559894a28c194e6cc9a797d0ed7f9b

RedLineStealer

+ 9'353 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:fote discovery infostealer spyware stealer

Link:

https://tria.ge/reports/221025-d3mymabdhl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

79.137.199.60:4691

Unpacked files

SH256 hash:

33066ce4bef405fbac4b2eb6a2bcbe5750e27173d026072b5c1e90e8d3786651

MD5 hash:

2fb4c2ed9b197f49f157f8908bad70c1

SHA1 hash:

de6a6baf7b8cc9198a9b82d96fa2be568207845f

Detections:

redline

Link:

https://www.unpac.me/results/e815ddbc-eb21-41e3-9f69-5fceaf68b37d/

Parent samples :

d8d42b8dfcaa679436d63aa693498c7586559894a28c194e6cc9a797d0ed7f9b
9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5
36c07f85265c76770103c0742059226287a05bee2a2909788f98eec6e8f96ba3
d6975d134cc13b002f41d1637336ae8e793da8f5024456f71b01123dc5d5c132
c3bccd847bcf72d889d41ef370d6f511873a217d650d264b0241de6029211962
3b992af9d5fd55a2f9351423c3d22ecc8c42a67a9605ec20c9540fcc89aa37d6
573dc9d49ffd81d7d5ffa800f8dfadf9979fcf9f6e996551d6f3747860d566c6
2dae85199cef5a4596e5bb6372a14c8dcd66f2fdbd7c02a1756736a660222e36
6e0eb2dc83c56083b168f4bf8f556f06c85f3cd3f982b6d23ff536ff2d7cb3d8
583b0791a0ba67d9dd1c0f542d8224a8293e767b8fb4c4308a0797d8a01d6989
732c92b1113b31b5dc22b9f7d933f168be4143d3dedd9529abd00fcfac37cf13
c721fa0c9b191e447c209dc63109c1761f53cfaf1d182c7e69c5d81a6eb16012
a6091a5db0adf12e6879ce846f5b2a8bf5ff2d0b23e1727d3a811f34e55b8d4c
353167a9e983ec9f3978cd6490317e84954a4abce5738a18c20a06a73d422172
de010f540aeb8c1063bf28ae0b1e5c0fa7203961c6d0c9c08ef3ddf0bbcd051b
0080bf59339551978336e60d9052ca6d465a9edde15f5cfb1e18e6e30b51bb2c
bdd5f29a6bc65ed2d617538e72f370c98803d198ad02bd05f63265619f19d8d6
7fb66e90aa395e63d9701a2b5c796742ccc900a5b02eae39b7aaebc6c69fadff
6758b66a9c92c51e493601f96be66a4f4f732726a931bed08da7c51de70ad9ea
d1cb52a054e3f0224a89e854b2e929de2eaee251b27b53cc1875bde298a385dc
77a68cfa4686fec4ec22430db2055fd445965a3c54ea4efe3bc6e2a9db698761
727c63018eb78455bec6fb25add5e9bd37fee57a032b38105670c20aad28c132
30c423066c7caa9bbcbceaddf5514e580d493eedd0d38ebf9702ddd75178d707
5ee821467a11f10fff154dea1df3b674053d0927415c21b50d71cc89c84af517
e6af7378031bea5b0236ba7b4f10d7578575369ee46f1b969d94382b87af697b
e74ad135c05286bc66601b2458cfd88341cd2a5df89dba45412f19a3deba0350
d24ede188cad559114ea25a00e18fde7932ef2ba3f547b290c4d84a770a0edb3

SH256 hash:

41250dbec57959b94d0c4dd692d7d44c831711e6fd112327d2a13d0cdf2e1e9c

MD5 hash:

1f998c36e316e3f4037634388d944bfe

SHA1 hash:

8819b057cabbe2527270645f235c7c4f87efb04e

Link:

https://www.unpac.me/results/e815ddbc-eb21-41e3-9f69-5fceaf68b37d/

SH256 hash:

01199f791dc7ab321edfc279bb75806967ac64058ea75ccf7be65e7007bb6081

MD5 hash:

0bb0655143bb0dfa7d14002e088e40ba

SHA1 hash:

4ad9e2ff6b0c242de558c3c28635c69769eb35ab

Detections:

redline

Link:

https://www.unpac.me/results/e815ddbc-eb21-41e3-9f69-5fceaf68b37d/

Parent samples :

9ccd52333f7ce04c90ae7c8234dbb77ce98a50e2c1e4837eab4f2d6bd60adffa
44a27380e5ae51d148a1d37510002973b6b993a586bcdd38ad74c102e9c6cacb
d8d42b8dfcaa679436d63aa693498c7586559894a28c194e6cc9a797d0ed7f9b
0dcc2bd7c4a939a83ad45a97276cc1f900b9983e90f7aa57fda1aa3b43fc6bc6
23ecd958cf9643c52e2951f734a39c7b250d7f185840955e62169b5b326d9439
25f4009278206d432081f8d3735cbbf7e3888a2e4f0bcf28c446ebae2b3c6c90
0629427415d61b098e8145081faeba2026d16aca3858dd873b48b2ae71ec8dba
7f57547f6b8deecb741ab99ee18acad723df2e2765c5523a30738dd8019b311d
1fb2cc77dcb40479b8c6c583024e1d84a4308087049152ff32bf71f18f436727
74d5ab938d203a407b3f3c6b461b76348fa24488905f29a333a7c35f34f9876d
9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5
2655839c505cc767477d2b085419022499540b62e97f1d35a347424c0fad635d
a7928ade0fd2c884b542a0a975b6c7c1710186d534f11a1b37003468e1fd35fe
36c07f85265c76770103c0742059226287a05bee2a2909788f98eec6e8f96ba3
d6975d134cc13b002f41d1637336ae8e793da8f5024456f71b01123dc5d5c132
c3bccd847bcf72d889d41ef370d6f511873a217d650d264b0241de6029211962
8ac158fb6e0c8502387f5fc4b8103fb500b5d5cc6fbbfdb5a14f4a65ca3f38fa
3b992af9d5fd55a2f9351423c3d22ecc8c42a67a9605ec20c9540fcc89aa37d6
573dc9d49ffd81d7d5ffa800f8dfadf9979fcf9f6e996551d6f3747860d566c6
e58955b8f25bd1f1fdbb0b3113b38cc23cf8faf3e33a47cd9b4bab0ab21957d6
0f7e88e649de21dabc1723a9e56996a330fe5d83ab17967fc6c014734c42cd71
2dae85199cef5a4596e5bb6372a14c8dcd66f2fdbd7c02a1756736a660222e36
6e0eb2dc83c56083b168f4bf8f556f06c85f3cd3f982b6d23ff536ff2d7cb3d8
583b0791a0ba67d9dd1c0f542d8224a8293e767b8fb4c4308a0797d8a01d6989
732c92b1113b31b5dc22b9f7d933f168be4143d3dedd9529abd00fcfac37cf13
c721fa0c9b191e447c209dc63109c1761f53cfaf1d182c7e69c5d81a6eb16012
083f6f9b13e9ad2991f61c0546dc65dd91e0efba57fb92b92ec9f3ca269c335a
a6091a5db0adf12e6879ce846f5b2a8bf5ff2d0b23e1727d3a811f34e55b8d4c
c5a76e9e41918d28a53329a85fa4d754882dc75f818785dd216bd4a363808f22
353167a9e983ec9f3978cd6490317e84954a4abce5738a18c20a06a73d422172
de010f540aeb8c1063bf28ae0b1e5c0fa7203961c6d0c9c08ef3ddf0bbcd051b
0080bf59339551978336e60d9052ca6d465a9edde15f5cfb1e18e6e30b51bb2c
bdd5f29a6bc65ed2d617538e72f370c98803d198ad02bd05f63265619f19d8d6
7b07c223a9901226587ee913ee4cb4eb192aeefea2d426476d3574c01a394a20
7fb66e90aa395e63d9701a2b5c796742ccc900a5b02eae39b7aaebc6c69fadff
6758b66a9c92c51e493601f96be66a4f4f732726a931bed08da7c51de70ad9ea
c2c314a7ee3f8547133ab172575c0bccb6001e0e44e8d59fc8495b8c4a8510dc
d1cb52a054e3f0224a89e854b2e929de2eaee251b27b53cc1875bde298a385dc
77a68cfa4686fec4ec22430db2055fd445965a3c54ea4efe3bc6e2a9db698761
aae531c59321039ba643a02edca74997e8143274cdd3cb3f60aae2ae93937244
a4b5bc9f7e30c488564c5e46a931b3bfb876e0a5261f7aee68b6751be7dfc8c3
727c63018eb78455bec6fb25add5e9bd37fee57a032b38105670c20aad28c132
cd117d8b7c622d97dbb7be50effb2c3b62283c4ca2e39a1acb27881c5596541c
30c423066c7caa9bbcbceaddf5514e580d493eedd0d38ebf9702ddd75178d707
5ee821467a11f10fff154dea1df3b674053d0927415c21b50d71cc89c84af517
0bd4b94ef5e037092835ff74b1ca2c0ec2d34e6d34f7fd29160d747e0d9b12cd
596fdbb265570ddc88e5778e82fc5ae93989d1426e6dc4752e1e431338eb0059
595ab0e3cd7b2fb79bd51109e09eb8ac33310cbdeb0b46c153baac996866e33d
f828ba7619d2d6b4fbff0339cb9c7a20183483871c8ca249d9d9a29997f4a376
23669f4b2ece67278303620bdac410d93786f7a129e10cde960110524deef557
8f31af78cb8453d43ffb37f21b7689ad1eaf9e5a7b356c97379a59bd4cf148a3
e6af7378031bea5b0236ba7b4f10d7578575369ee46f1b969d94382b87af697b
e74ad135c05286bc66601b2458cfd88341cd2a5df89dba45412f19a3deba0350
d24ede188cad559114ea25a00e18fde7932ef2ba3f547b290c4d84a770a0edb3

SH256 hash:

9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5

MD5 hash:

cff029aeed9b539f3a6ed65ca0a08795

SHA1 hash:

90cf05748fc1cfdf3b054ac3ad09cd697434a374

Link:

https://www.unpac.me/results/e815ddbc-eb21-41e3-9f69-5fceaf68b37d/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9054439f2563/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9054439f2563b668a4fcd1e2b0223072431fc905947b7c806cc35c8952e515b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.