MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b
SHA3-384 hash: e6c57c5e4f0274504042a4ba22c84ebb92bd7759bff237cf36b0d09dab40edb4808e6f832a603fb1ae940b82b9fa50c9
SHA1 hash: e8bc3bb6d0cb740997157abff9dc6a197ffb0582
MD5 hash: d01308e5e8cee3a13256d3ed82fea342
humanhash: texas-shade-oscar-maine
File name:d01308e5e8cee3a13256d3ed82fea342.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:364'544 bytes
First seen:2022-12-30 01:05:17 UTC
Last seen:2022-12-30 02:30:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 18f1ce522b0f7e717ce8c81fcf5d6257 (4 x RedLineStealer)
ssdeep 6144:dcOeNahNPMQWRBlTywS7AOIJm7lMMn6P86kVZ9s1Jl:neNahxMQs473bn6E6k61J
Threatray 1'962 similar samples on MalwareBazaar
TLSH T11774F43960A18421C46A3431F9FCD9AD382CF813C75679ABD3F53E7BBA2C2917123856
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.42.244.249:5514

Intelligence

File Origin
# of uploads :
2
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
d01308e5e8cee3a13256d3ed82fea342.exe
Verdict:
Malicious activity
Analysis date:
2022-12-30 01:05:50 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/39ed976f-1371-4b22-b065-fd6730824568

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Fragtor.185528.23624.5179.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware ransomware smokeloader
Link:
https://www.filescan.io/uploads/63ae397b40e878e304212671/reports/9f5ecc20-ce41-4839-898a-e43773977879/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/19c028ba-4b0a-47aa-b89c-367b87a545ba
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1142986
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-12-30 00:40:01 UTC
File Type:
PE (Exe)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=trslzjyp45iypxfmrpad54cwm7pprfd7cffifpgprm4srq3kaz5q._file
Verdict:
malicious
Similar samples:
018a65e059d418802b351b4611fe09093e5b50562143ce5a522c28ef0f0bcf10
RedLineStealer
11e6cd39dabb4482b7e95adb92336fa17fc46df16b72ec72ef922f79857d752e
RedLineStealer
2ac9675aa85fdc4ae911e08d08e3bf773dae1edd9a1beb0a0450bccaa2e6441d
RedLineStealer
489f124e6f32e3b81dd2a458efec84153018d835ecbf28562440b05d8899a051
RedLineStealer
61a1cd94691b0e620eeb4ff4d424f48d07419b4de4ee27cfcadf2ee759b32004
RedLineStealer
639d797ca8e9aa8de8544cdf900682191797d640c76ea3880609fb3ec7fc3c43
RedLineStealer
6a38b624b2c17709d11ed370e10c9a4cb914bfd2deb331d18403a3e89917bb34
RedLineStealer
6ea1d03968fc6cc0faa8d80a7cff8451d260a6e89a8e6ab4e068c37acac0ed9b
RedLineStealer
9327393673ff9ae5509ec33ebe7f750d139d2b4e5faf05ea95a372be2331282e
RedLineStealer
b3631f77ec6c54f3bbbb2b2b59a647e3bcc3b330516c0b6de96113be9369ca46
RedLineStealer
+ 1'952 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:redline bot infostealer spyware
Link:
https://tria.ge/reports/221230-bf3pfshh5z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
RedLine
Malware Config
C2 Extraction:
193.42.244.249:5514
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/364f2008-6de0-4ffe-a7a0-83dd9782ad05
Unpacked files
SH256 hash:
54f1a603ca015d94b530ecad2f88a50b0dbea189942d6443aa1d598bc995b008
MD5 hash:
8f23d1195d615cdfaab2b1007db71f6b
SHA1 hash:
84b5939c32bb494be7b58f34241a0441cf98d3b8
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/fd302617-af49-4542-af50-fedc254a456a/
Parent samples :
61a1cd94691b0e620eeb4ff4d424f48d07419b4de4ee27cfcadf2ee759b32004
9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b
501f2463bdfc1e0260205d87eab7bcfe23254cefb6f43923172bb852cc96b2dd
ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c
99b21510e79967ae3ad4e40e757263ae61d5b8e5d3cecc76cfcfbff7b4848b10
691bfda349d0e18174260f9104159c4828b3ec20a53db6db96e8bd4560ffaa84
SH256 hash:
9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b
MD5 hash:
d01308e5e8cee3a13256d3ed82fea342
SHA1 hash:
e8bc3bb6d0cb740997157abff9dc6a197ffb0582
Link:
https://www.unpac.me/results/fd302617-af49-4542-af50-fedc254a456a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9c64bca70fe7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Win32_Trojan_RedLineStealer
Create hunting rule
Author:Netskope Threat Labs
Description:Identifies RedLine Stealer samples
Reference:deb95cae4ba26dfba536402318154405

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2485916/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2490122/
  
URLhaus
https://urlhaus.abuse.ch/url/2487101/

Comments