MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f25264d954d82b3ef3dd1ab336bd7dad2ca7132b90c20128de327e1fb02f9cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments 1

SHA256 hash:	9f25264d954d82b3ef3dd1ab336bd7dad2ca7132b90c20128de327e1fb02f9cf
SHA3-384 hash:	35388763ce5fbf224fdf1475cd718ea43c4cebb9d845b5cc30f280ab5b52b71ab9a2c9b6c8b0d92cb1a3db216ea9f089
SHA1 hash:	d35b157f350469c525fb568714b06a5d4657dfec
MD5 hash:	f67b2dbd69883843a59ef380af38cb32
humanhash:	east-yellow-tennis-island
File name:	f67b2dbd69883843a59ef380af38cb32
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	868'384 bytes
First seen:	2021-11-23 17:54:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	13406bbb144b5e7ad49c92017b5f5456 (1 x RedLineStealer)
ssdeep	24576:TzjrioQRN45ZBQPIwZTipU2q9meVqnfrUZUT9ex+/:HbYN+Ve5pT+
Threatray	1 similar samples on MalwareBazaar
TLSH	T1F70523EAC73AD202D1A98033AA195C16B735F505B5EDAFBB474019B0FE67B0B7C15A30
File icon (PE):
dhash icon	f8cefaccec2c6ecc (1 x RedLineStealer)
Reporter	zbetcheckin
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f67b2dbd69883843a59ef380af38cb32

Verdict:

Malicious activity

Analysis date:

2021-11-23 17:58:10 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/a744adb8-78bb-48cf-ad75-c218596f8b25

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

Win.Malware.Zusy-9908145-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Searching for analyzing tools

Сreating synchronization primitives

Sending a custom TCP request

DNS request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/619d2afc02c80febc2a75030/reports/b961bca6-1f8f-4302-ab8f-3b2724405cf6/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f582f518-b047-45df-85b9-554cad49cca2

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/894951

Signature

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file has nameless sections

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9f25264d954d82b3ef3dd1ab336bd7dad2ca7132b90c20128de327e1fb02f9cf/

Threat name:

Win32.Infostealer.Generic

Status:

Suspicious

First seen:

2021-11-23 14:13:06 UTC

AV detection:

9 of 44 (20.45%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=t4ssmtmvjwblh3z52gvtg26x3ljmu4jsxegcaeun4mt6d6yc7hhq._file

Verdict:

malicious

Label(s):

ryuk

RedLineStealer

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211123-whfypaahbm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Unpacked files

SH256 hash:

56bdcd1fd406ddc6829e69cdb007816137dc057d8c266f4f4c4ea4380657d6e6

MD5 hash:

28fb5f46e9f4cc3a062e20400791551a

SHA1 hash:

aa338ed1a3156320f63ea4c4c02553205f797a57

Link:

https://www.unpac.me/results/14420b99-2d85-42d5-9701-cadaa351b51d/

SH256 hash:

9f25264d954d82b3ef3dd1ab336bd7dad2ca7132b90c20128de327e1fb02f9cf

MD5 hash:

f67b2dbd69883843a59ef380af38cb32

SHA1 hash:

d35b157f350469c525fb568714b06a5d4657dfec

Link:

https://www.unpac.me/results/14420b99-2d85-42d5-9701-cadaa351b51d/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/9f25264d954d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f25264d954d82b3ef3dd1ab336bd7dad2ca7132b90c20128de327e1fb02f9cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time