MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d613d4d96cdfb56791f2bb39a600e337a6195afa1060f367534d384aa6cdc55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	9d613d4d96cdfb56791f2bb39a600e337a6195afa1060f367534d384aa6cdc55
SHA3-384 hash:	e35b3ef0c7c75cbf2779f2af161abf9c3eda5b6e747ebf6576c34ad7302915b6e847972715c2d2341fe46d70d9752d9a
SHA1 hash:	7dacf2f5a59d164e3ecec628b88c0ebcd2fff5b5
MD5 hash:	0d4658ce9ef6be70aaadab4865cb4241
humanhash:	lion-echo-salami-happy
File name:	0d4658ce9ef6be70aaadab4865cb4241
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	2'537'377 bytes
First seen:	2022-07-22 10:39:06 UTC
Last seen:	2022-07-22 16:53:00 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	da0a8429d07681e0f845d1d4f08ae833 (28 x RedLineStealer, 2 x ArkeiStealer, 1 x PhoenixStealer)
ssdeep	24576:Qzd0lPFUbC2Y3YH9i7JmgMrVdzNy43uObeqkr647yh7DaqLYLjDZ+zWl3RuQ553O:Q6lPFUb4nS/j47yh7DaqcLjDwCl3y
TLSH	T123C50A136ACB0D75DDD23BB4A1CB633AA734ED30CA3A9B7BB608C53559532C46C1A742
TrID	33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 21.3% (.EXE) Win64 Executable (generic) (10523/12/4) 13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	openctibr
Tags:	exe OpenCTI.BR RedLineStealer Sandboxed

Intelligence

File Origin

# of uploads :

# of downloads :

251

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

0d4658ce9ef6be70aaadab4865cb4241

Verdict:

Malicious activity

Analysis date:

2022-07-22 10:43:09 UTC

Tags:

redline trojan rat

Link:

https://app.any.run/tasks/53615ff4-57c2-4d3f-8e9c-ac43e732cd00

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/293353/

Detection(s):

Win.Packed.Generickdz-9957151-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/27016/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug arkei overlay packed redline spyeye

Link:

https://www.filescan.io/uploads/62da7e88ef2b0e63a830f78d/reports/1e6b8eec-c1c3-4c7e-a8a0-981f4604dd97/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/61a5cdf1-e04e-4864-8a78-57785bafe7ea

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1039146

Signature

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Snort IDS alert for network traffic

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9d613d4d96cdfb56791f2bb39a600e337a6195afa1060f367534d384aa6cdc55/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2022-07-20 13:54:21 UTC

File Type:

PE (Exe)

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tvqt2tmwzx5vm6i7fozzuyaogn5gdfnpueda6ntvgtjyjktm3rkq._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:topp infostealer spyware

Link:

https://tria.ge/reports/220722-mqjj4segcn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

Malware Config

C2 Extraction:

blcesalenial.xyz:80

Unpacked files

SH256 hash:

7231ce0a8779530197cf521ebeb7a84c2544b583d061ea88d20c1f2ffd796a31

MD5 hash:

3f040180d6af83f52c3e4f41787e2492

SHA1 hash:

dc933f69bc1d85391bfb7a73f1b646129eb8c489

Link:

https://www.unpac.me/results/24927e96-3ce7-4c73-a0ef-a349e5107c71/

SH256 hash:

9d613d4d96cdfb56791f2bb39a600e337a6195afa1060f367534d384aa6cdc55

MD5 hash:

0d4658ce9ef6be70aaadab4865cb4241

SHA1 hash:

7dacf2f5a59d164e3ecec628b88c0ebcd2fff5b5

Link:

https://www.unpac.me/results/24927e96-3ce7-4c73-a0ef-a349e5107c71/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9d613d4d96cdfb56791f2bb39a600e337a6195afa1060f367534d384aa6cdc55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sectigo_Code_Signed Create hunting rule
Description:	Detects code signed by the Sectigo RSA Code Signing CA
Reference:	https://bazaar.abuse.ch/export/csv/cscb/