MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
SHA3-384 hash: 8309614725cb267b293c45e5cd2247b5a281c12da1abc50ef8fd6c58f64d79ace2c6615e2932be715143525d40e1e9e4
SHA1 hash: 212668f3d8a06e7e0aa6fc297f1ca494ab8b5cf7
MD5 hash: cc179f2e9a9fb118fbe3e3e6fa94a268
humanhash: kansas-king-social-tennessee
File name:cc179f2e9a9fb118fbe3e3e6fa94a268.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:329'604 bytes
First seen:2022-11-15 11:21:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 81cb68cc20ee69ac5f93f68a2f825c6d (15 x RedLineStealer, 7 x Amadey, 6 x Smoke Loader)
ssdeep 6144:eUgLpjp90jrpL6sz42bqrJiZXU+lpEoZ2v3pCLT0mY0:eUg91qjrlJzCUZXU+7E3v5CLTJP
TLSH T10264022279A0C073C60768304869C2E17B69FDF169759687BB8C3F1E6F312D26B66707
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2dac1370399b9b91 (45 x RedLineStealer, 35 x Smoke Loader, 19 x Amadey)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
cc179f2e9a9fb118fbe3e3e6fa94a268.exe
Verdict:
Malicious activity
Analysis date:
2022-11-15 11:22:14 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/f254f0c0-832e-46ff-8b03-66d75381ed4f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/334187/
Detection(s):
SecuriteInfo.com.Malware.PDB-35.UNOFFICIAL
Create hunting rule

Win.Packed.Botx-9977720-0
Create hunting rule

Win.Packed.Botx-9977721-0
Create hunting rule

Win.Packed.Botx-9977732-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader45.31457.28528.4358.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6373765df75d59fef0b973cb/reports/ab53d78b-f375-4f54-ac74-d5b5e4248764/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0f3ee222-47d7-494b-8ef8-2a657bfc79b4
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1113697
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-15 11:22:07 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
28 of 41 (68.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sodgz5bz67lpvyigavr7ndl663ranh5zadgpcm3y2cg2hoyfhxpa._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:123 infostealer
Link:
https://tria.ge/reports/221115-ngklgshd4s/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine payload
Malware Config
C2 Extraction:
78.153.144.3:2510
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7abc773a-fe7a-4b9c-9522-475dc3123954
Unpacked files
SH256 hash:
6efe7fd02d5f6478042dbbe35d7613e2136b9a41acf3e93c0340f2b2ec0186b6
MD5 hash:
6294c16b02fc00aba7f74b89d14a6b5e
SHA1 hash:
f8103857ba2223810975403330f813c3ffbd3f74
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/23debb6b-7a98-420c-9c77-21b583496ba0/
Parent samples :
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
5520de785a54df91deda63975bfea2bce483e8020928aaf8eed5c8ce664f0db2
bbe934a832db11f1f3162fa27be965a88f92b8a25cfe965b6076669d3da8202e
cb30fb7ffcd9881326c240d4b3251d174a578b3ddf56653d276a540890799f97
04a31421bf2de2881d9958bf918c92d1ee988f670ce6200dca8064a6581d33f9
3895be69980fb6b7664e012d102c2e81cbc38de70708d98b3b832236ada6c041
086a34bfeac2c52d33f2d3f04cbba8a549de789c81d6f3fd1ea9c5505e665dea
93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2
f8c1e98bd43ca372b1411738dc5b392a2a41f88093793a17289663ee0fc0406f
a858a5d669f0f5523be8d7e6bca2410b280d4637bcc60a2c468b46b6b70ae8cd
3240455c14048d3813e37e909420e90f7d2afe0a6d73efdf6e6aa7b96b63ebd1
fa6defc9dadc86b3ce81f02e437a24af6b995fb6616a0ecb073b090bdbfd801d
6964a2dc13ce980cd9126100a4fa1bb882b89815eba044a091217e1f9bc9e649
SH256 hash:
c9638104c213938fc16795163bdc0faf71f8507afbc2d8f581a0523724514758
MD5 hash:
c01706a812e7540617dbcc6e76456947
SHA1 hash:
e3d147be06d724d2b6c87c99306805256b1d8212
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/23debb6b-7a98-420c-9c77-21b583496ba0/
Parent samples :
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
bbe934a832db11f1f3162fa27be965a88f92b8a25cfe965b6076669d3da8202e
04a31421bf2de2881d9958bf918c92d1ee988f670ce6200dca8064a6581d33f9
3895be69980fb6b7664e012d102c2e81cbc38de70708d98b3b832236ada6c041
086a34bfeac2c52d33f2d3f04cbba8a549de789c81d6f3fd1ea9c5505e665dea
93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
a858a5d669f0f5523be8d7e6bca2410b280d4637bcc60a2c468b46b6b70ae8cd
SH256 hash:
8e4a9fc9820dfc3fdfc793aec3676d06b5b4ebfe512a62eb4a9032d0735f775c
MD5 hash:
42cfadd8c7cac115b2813dcdc145f5ec
SHA1 hash:
1d6d4f6cc24dcf3dde14a8ea4c9a6930447d044d
Link:
https://www.unpac.me/results/23debb6b-7a98-420c-9c77-21b583496ba0/
SH256 hash:
93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
MD5 hash:
cc179f2e9a9fb118fbe3e3e6fa94a268
SHA1 hash:
212668f3d8a06e7e0aa6fc297f1ca494ab8b5cf7
Link:
https://www.unpac.me/results/23debb6b-7a98-420c-9c77-21b583496ba0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/334187/

Comments