MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f3d31eae0e7a98951701870f892aedf680156bf91f472fd54224b28b2eb0c08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f3d31eae0e7a98951701870f892aedf680156bf91f472fd54224b28b2eb0c08
SHA3-384 hash: 168cfe28b5b6b5e1123bdc610d774a7dc6d90bde68bd6427c85066e7c6fbeefab81e3d6284a2b65c2db3e60befb8e858
SHA1 hash: c98d4ee0689d0426c5e18187c49fcf9900c1e56f
MD5 hash: acc686c584f0e579fc51cab444ecb3fd
humanhash: hot-gee-jig-fix
File name:acc686c584f0e579fc51cab444ecb3fd.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:131'072 bytes
First seen:2021-05-05 17:41:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:QBmfWDxUNx0iUZGPzFK5u6Ju1GBSBoEyJdhnhmbg:bmE0WdVyqb
Threatray 316 similar samples on MalwareBazaar
TLSH 33D34B2E635C4F24F6BC46B56570022747F0D1EF2112EBBE8FD468DE2E267C62A485E1
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.102.136.251:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.102.136.251:80 https://threatfox.abuse.ch/ioc/29407/

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Coins-9854091-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/712320
Signature
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f3d31eae0e7a98951701870f892aedf680156bf91f472fd54224b28b2eb0c08/
Threat name:
ByteCode-MSIL.Infostealer.RedLine
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 04:48:00 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t46td2xa46uysulqdbyprevo35uacvv7sh2hf7kuejfsrmxlbqea._file
Verdict:
malicious
Similar samples:
149cfe6af20dd3b333e87fe3b9d764ca9c62d2ab3846845f2a210b8c3695eeba
RedLineStealer
301a510700f2ebccd25fc5cc6c579ead2196b957ed81aa3eda29c7bc40887c26
RedLineStealer
308087aed8b1e2e06ca043977cbbf86dfa5616ab76cd2a7b9a1ae48b747767aa
RedLineStealer
6da762e6a282e959a607c046a3b33dd71baaf6c7fe5d49c97a8e2de2a60e4c5d
RedLineStealer
8cfbe99de13e5eec5ef9e5ce5b6f66412b65be60db48515ac9cb26a6aac4291a
RedLineStealer
90a286ac5b49100aeb8038af277dbabc3853e6fe5557c19d5a64885f015596b1
RedLineStealer
92f38b474f16faa935aa1976979c81fbc9c296e584d86fd8b9c7c8751c1a968f
RedLineStealer
98c61b84f915ff63f9d5677d1ee53e1fb8aff4567eda30a374321424875dd913
RedLineStealer
9a0d57d82e15f4f45a2442d1d5355242a0fe4684039777025622dfa95a8caeec
RedLineStealer
e578c441df91736e8ccad4ee9a3f94a628a281e62e4f9c8dbb0f1f615831b557
RedLineStealer
+ 306 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:15.04
Link:
https://tria.ge/reports/210505-p64kttnygx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Malware Config
C2 Extraction:
lensifa.xyz:80
Unpacked files
SH256 hash:
9f3d31eae0e7a98951701870f892aedf680156bf91f472fd54224b28b2eb0c08
MD5 hash:
acc686c584f0e579fc51cab444ecb3fd
SHA1 hash:
c98d4ee0689d0426c5e18187c49fcf9900c1e56f
Link:
https://www.unpac.me/results/7b570a25-7df7-4819-a3c1-510ee6e21edd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f3d31eae0e7a98951701870f892aedf680156bf91f472fd54224b28b2eb0c08

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments