MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d
SHA3-384 hash: 34b1670965e6dcbeece58c2a5bcbcfe22bb6a051d84b6e4d0b48bc48d32a2cc0348840279820e8d56274017a445b0bb2
SHA1 hash: cea8b03be5e8e65e61dda0552e5f5df0c7cf6aea
MD5 hash: c023af232f2739f4b0d638b0fa1b0ff7
humanhash: lion-high-thirteen-table
File name:9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'263'160 bytes
First seen:2022-05-20 06:55:16 UTC
Last seen:2022-05-20 07:59:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b9c3c1592f11f23844ce8b62fe6373ac (7 x RedLineStealer, 1 x Neurevt, 1 x ArkeiStealer)
ssdeep 24576:XDx0t6Tnyu1KNHfvtsL8liqPkus1p9L+r1Qw9f:zx0aA4401Q1zf
TLSH T17B45F1447075C039E41714B598AA97A0B12EBC609B68A0CB27F3BFAF777B6C19875307
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 8e2349d9f161339e (1 x RedLineStealer, 1 x Amadey)
Reporter JAMESWT_WT
Tags:exe exxon-com RedLineStealer signed

Code Signing Certificate

Organisation:exxon.com
Issuer:GeoTrust RSA CA 2018
Algorithm:sha256WithRSAEncryption
Valid from:2021-12-30T00:00:00Z
Valid to:2022-09-02T23:59:59Z
Serial number: 0a2787fbb4627c91611573e323584113
Intelligence: 18 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: cec6df3094d2530c2a8f1eee310e12dc768a5b0b23273ee89aef01fae2695948
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d
Verdict:
Suspicious activity
Analysis date:
2022-05-20 07:20:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/574e14c8-baf1-4a83-b13d-bad6a630ee56

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/272877/
Detection(s):
SecuriteInfo.com.Variant.Jaik.74385.11596.20209.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19124/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62873bc2370bb1455cb719fa/reports/3247a629-511a-4a79-9c16-1d1f7c0d9703/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/234df63f-33ad-482c-aecd-db7a021cebbe
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/998319
Signature
Allocates memory in foreign processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 19:52:19 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
18 of 41 (43.90%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5i7nxfb3bo3ujp3gpjmeqxmb2l5m7ms26twkzksqwhxle2qhmgq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:936838460 infostealer spyware
Link:
https://tria.ge/reports/220520-hqcdksega4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine Payload
Malware Config
C2 Extraction:
193.106.191.253:4752
Unpacked files
SH256 hash:
5bb261ea66a60fa5c5ed6708125e441d8ebcd736cef76b0808c012284b6292e6
MD5 hash:
1920b99bb7d48276461434c92792f0ff
SHA1 hash:
3b771990247e7b887fbfbe8c4e87b5325d496806
Link:
https://www.unpac.me/results/13c38b18-b326-422e-bf28-c65516c622ea/
SH256 hash:
51e141ef01234704c0a99766cbec68aa6130156e7c609c092d4b4bf3f755dab9
MD5 hash:
9db669cf0bdbd3f7bfac0c02cb6fa8bb
SHA1 hash:
0db60beaaac71f0a245ddabdde7b0869898b8e4e
Link:
https://www.unpac.me/results/13c38b18-b326-422e-bf28-c65516c622ea/
SH256 hash:
77fa36e4bcf59e143459e6e219cdb2bf7804923a593ace19e6faf4bedff2c289
MD5 hash:
3b65683bd82ba42a954e4eadb4dd9166
SHA1 hash:
d6b78285b39136f7c22f6781693936d2668cb8fd
Link:
https://www.unpac.me/results/13c38b18-b326-422e-bf28-c65516c622ea/
SH256 hash:
9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d
MD5 hash:
c023af232f2739f4b0d638b0fa1b0ff7
SHA1 hash:
cea8b03be5e8e65e61dda0552e5f5df0c7cf6aea
Link:
https://www.unpac.me/results/13c38b18-b326-422e-bf28-c65516c622ea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f51f6dca1d85dba25fb33d2c242ec0e97d67d92d7a7656552858f7593503b0d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/272877/

Comments