MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f157ceaee5858d2f77f1f828d9dc8417c7c99a65b4412896ac0231416336393. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments

SHA256 hash:	9f157ceaee5858d2f77f1f828d9dc8417c7c99a65b4412896ac0231416336393
SHA3-384 hash:	e49c1e0deee9e1579fe830abbbd67545d8150e368b1e2432b28a21d3d026dc390a805f8ae4903d810893c2a727517940
SHA1 hash:	fb54be90b52c3ae67fa36c4b42058c4a96bd0d34
MD5 hash:	9bc141f0b7550df94f713e0962b736d3
humanhash:	cardinal-mirror-robin-fix
File name:	9bc141f0b7550df94f713e0962b736d3
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	387'072 bytes
First seen:	2022-02-05 18:34:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1a3cf179d845c62d49a765b8e54e41fa (4 x RedLineStealer, 1 x Stop)
ssdeep	6144:pGJItNqakccUCseBAKH3GH1QYvVDnFqvU66tfdyHNdlxpOLKBFss/KsmO1wfze97:pdNqKRCsepH3GHOK4cdtMlwsWs/3oLe
Threatray	4'608 similar samples on MalwareBazaar
TLSH	T14584CF10BB90C035F1B752F449B693ADB63E7AA25B3451CB63D167EA1A346E4EC3130B
File icon (PE):
dhash icon	b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
45.11.26.87:81	https://threatfox.abuse.ch/ioc/379466/

Intelligence

File Origin

# of uploads :

# of downloads :

215

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

http://guseyn.best/MediaPlayer.exe

Verdict:

Malicious activity

Analysis date:

2022-02-05 18:26:14 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/2a8b2aac-16fb-4052-bd4b-46afc47512f4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/233618/

Detection(s):

Win.Packed.Filerepmalware-9938531-0

Win.Packed.Filerepmalware-9938532-0

Win.Packed.Filerepmalware-9938533-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Сreating synchronization primitives

Sending a custom TCP request

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Query of malicious DNS domain

Sending a TCP request to an infection source

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/6075/overview

Behaviour

MalwareBazaar

CPUID_Instruction

SystemUptime

MeasuringTime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed smokeloader yakes

Link:

https://www.filescan.io/uploads/61fec359a72f86da695eb234/reports/55003464-5aef-4516-be01-d6f731881820/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2ce79f78-7ebc-4acc-a90a-a33efe484f40

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/934613

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2022-02-05 18:35:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 43 (39.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t4kxz2xolbmnf537d6bi3hoiif6hzgnglncbfclkyarrifrtmojq._file

Verdict:

malicious

RedLineStealer

1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45

RedLineStealer

20dc6e65625512bceeed56e1754a96608ad8eb6e5648ec995a2a6fe6c2f6689f

RedLineStealer

2eecd263f2ccf106ab5ad42ed0bb8c981f9067a1273cc3186cb731aac8fbb702

RedLineStealer

51dab2aed9a33526c883c60b970d756e7fe8215630861d61c839d4a491a91120

RedLineStealer

7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574

RedLineStealer

819c9d8c88fc1ffbfeae1797646f7b90f930fef4dae513fe8e43fad3bf475bf0

RedLineStealer

9e719c4dd5e1086d5197fded7b8cdb0d3d592c0636b0d469fcda22c9723e8e7c

RedLineStealer

ba195a9f090cb803df55df40d839f95e335234a13d3207f65efa46c3d0f837d0

RedLineStealer

+ 4'598 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:3 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220205-w8cc7aebh4/

Behaviour

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

stata2021.best:81

Unpacked files

SH256 hash:

fd684e2651ae87a4fd35c6d580452ebbb76275edaf3480f7ba9a43b0089db1d3

MD5 hash:

3c83586d45a594693b69cc93ee3982d4

SHA1 hash:

7b7cfe6d6468cec7a0f0c3c337ed4c82d1cd0f81

Link:

https://www.unpac.me/results/f63d7fab-92d0-43a8-a982-80fb143515fd/

SH256 hash:

61edfd031866feacee8d45d600ad19336e22f76c117d08a9d9f038fa67c31d27

MD5 hash:

e65bbbc4537f602f9e86145e4f49c959

SHA1 hash:

64d2d32d67c8edee0130c8de0f59108340ef75fe

Link:

https://www.unpac.me/results/f63d7fab-92d0-43a8-a982-80fb143515fd/

SH256 hash:

9aad52a48dd081e3f56e95ab6803049b2364afedb10efa788c374050addb19de

MD5 hash:

7b53035d6feebceddd613b8c250786ed

SHA1 hash:

1a9b3af36f07f5ce294c7388af619334e9875992

Link:

https://www.unpac.me/results/f63d7fab-92d0-43a8-a982-80fb143515fd/

SH256 hash:

9f157ceaee5858d2f77f1f828d9dc8417c7c99a65b4412896ac0231416336393

MD5 hash:

9bc141f0b7550df94f713e0962b736d3

SHA1 hash:

fb54be90b52c3ae67fa36c4b42058c4a96bd0d34

Link:

https://www.unpac.me/results/f63d7fab-92d0-43a8-a982-80fb143515fd/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/9f157ceaee58/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f157ceaee5858d2f77f1f828d9dc8417c7c99a65b4412896ac0231416336393

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.