MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95e10732f29481aac7d12371cb3c49b8f1a739af355d5f66615e44f1a8a4d2db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments

SHA256 hash:	95e10732f29481aac7d12371cb3c49b8f1a739af355d5f66615e44f1a8a4d2db
SHA3-384 hash:	b7a5f88049367de05c9259835b91c31472e73bab0a5713a3024d3ca77b176cf4c9ef079bb3c67a4731c693bcf8e0fab9
SHA1 hash:	2b873441f1dc8da1779bb059daefbecb0e0c0cf5
MD5 hash:	3585704b66818021ffe827eb4ba25169
humanhash:	aspen-fanta-monkey-mobile
File name:	3585704b66818021ffe827eb4ba25169.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	451'072 bytes
First seen:	2022-05-17 08:58:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1f8c4cf685a1da89700dff1891ed4f70 (2 x RedLineStealer, 2 x Loki, 1 x Stop)
ssdeep	6144:e2haD1FIBv/VhX/PWdlNaWFaoAuSHKh6JOXlT7z4zOSOg8YzfhWBQn9o:e2+Il9h3WdlNLIuS8lmCQz5l
Threatray	2'845 similar samples on MalwareBazaar
TLSH	T1ABA4BF00BB60D035F5B716F4897A8268752EBEE16B2451CB63D57BEE96356E0EC3030B
TrID	39.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 29.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	e49a4c1d1c4ceef0 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
193.106.191.182:15304

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
193.106.191.182:15304	https://threatfox.abuse.ch/ioc/579232/

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

3585704b66818021ffe827eb4ba25169.exe

Verdict:

Malicious activity

Analysis date:

2022-05-17 09:02:07 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/bd02080c-8a80-4165-a0cf-c186d0179766

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/271436/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/18229/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/628363e7cc43366302d08ca6/reports/ad05ec1b-0cc6-4d63-a092-f1a39bc7dbee/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7c4167b4-5fae-4ad0-9ebc-069b9ee5e2e7

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/995629

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95e10732f29481aac7d12371cb3c49b8f1a739af355d5f66615e44f1a8a4d2db/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2022-05-17 08:59:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sxqqomxsssa2vr6reny4wpcjxdy2oonpgvov6ztblzcpdkfe2lnq._file

Verdict:

malicious

RedLineStealer

39e86dd37c077329a6c8e5f74816c2becd12d07cef0c5b85a6c7fa26f11e10b8

RedLineStealer

60b8f18ed7dd7437d8a74fba1d1bfbabc9b01f41ad1769a19b7e8a0e27178c8a

RedLineStealer

8a9368e459952f9652f83bdbb2e834bc7227d2f22e7d07980ab489c1df3ea0a1

RedLineStealer

a54f73244c237c8978e4fe95c07361b177b5cc231ac6fbb630008fab8b9e17f6

RedLineStealer

b58cf8bb43db324c143063370deeb7cffe72be6f6cdd0a4e80667154e78f3c89

RedLineStealer

bca2c09da2ac26b5be5d42da826ad9d62403cf6351957800db6af4029c372bb6

RedLineStealer

+ 2'835 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:50red discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220517-kxp95acdbl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

193.106.191.182:15304

Unpacked files

SH256 hash:

0d8341d729309050e670f45cd774cec92b81684a80737dde2061a40f1a1c80c9

MD5 hash:

8ab657af0523ba80c90f331ceb135cd4

SHA1 hash:

d103505815c42f21d83283beba71696b84f223e5

Link:

https://www.unpac.me/results/e6b86717-e29c-4e01-a710-7697e91d46e0/

SH256 hash:

43fff96fd49650591710512dd1eb60f9a5c7447a5f251efd1692cf8efc6aa512

MD5 hash:

8ddf60ebd6fac620fffffb2b341aa339

SHA1 hash:

ab5b42d730dfe1c801cd9182e2b244342e15577f

Link:

https://www.unpac.me/results/e6b86717-e29c-4e01-a710-7697e91d46e0/

SH256 hash:

dd0bd311f7c91b86b4ab8255a9de905ca81e76136616b428b8e07feadd1fdd4c

MD5 hash:

5ecea6038845df04d071129b2586bfba

SHA1 hash:

9188b1fc6920450610190cd263f4f92f856c9f50

Link:

https://www.unpac.me/results/e6b86717-e29c-4e01-a710-7697e91d46e0/

SH256 hash:

95e10732f29481aac7d12371cb3c49b8f1a739af355d5f66615e44f1a8a4d2db

MD5 hash:

3585704b66818021ffe827eb4ba25169

SHA1 hash:

2b873441f1dc8da1779bb059daefbecb0e0c0cf5

Link:

https://www.unpac.me/results/e6b86717-e29c-4e01-a710-7697e91d46e0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/95e10732f29481aac7d12371cb3c49b8f1a739af355d5f66615e44f1a8a4d2db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.