MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 18

Intelligence 18 IOCs YARA 3 File information Comments 1

SHA256 hash:	9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a
SHA3-384 hash:	13bd65d82b65958ef41173727bb661ee3805e048f99abc31101ed23333c3ede4500b1ac7ef1afd6f44367768af5ae921
SHA1 hash:	5dbd4dff21956f908697c0ffbc24c63d07eaa345
MD5 hash:	5878d2c316a84469a950dabb79c668cd
humanhash:	tango-wyoming-july-salami
File name:	5878d2c316a84469a950dabb79c668cd
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	495'616 bytes
First seen:	2024-01-23 18:47:07 UTC
Last seen:	2024-01-24 04:29:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bf5a4aa99e5b160f8521cadd6bfe73b8 (432 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep	12288:fh18k70TnvjcnuqNy20CjVDafCJETz6ux7K7uXHxLKT:Mk70TrcuayA1aaJEHXx7suRKT
TLSH	T103B4012076C1C1B3C4B7513045E2CB759E7A74310BB992D7B6AD177A2E203E6A7362CE
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

526

Origin country :

Vendor Threat Intelligence

Malware family:

smoke

ID:

File name:

d55397282fd5a56d06fae62f5e18237ecd28dc53caeb5e993b66ed81ce6e7881.exe

Verdict:

Malicious activity

Analysis date:

2024-01-23 21:29:38 UTC

Tags:

loader smoke smokeloader povertystealer

Link:

https://app.any.run/tasks/37204e93-76ca-49de-9200-d3c8f66c077d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/472565/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Creating a window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Сreating synchronization primitives

Stealing user critical data

Unauthorized injection to a system process

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint packed stealer

Link:

https://www.filescan.io/uploads/65b009e53b46cfd29c180813/reports/d858042a-390b-40cf-a656-00e1ab06e106/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e7c6cdd5-0522-49a1-93da-5b3156a452a4

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1379796

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2024-01-23 18:48:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=t6cs5t2hvihmcnc7md2sh4bu4o3vj5vexczky6sauvasirx4d6na._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:@new_cloudnever discovery infostealer spyware stealer

Link:

https://tria.ge/reports/240123-xfrsvafahq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

.NET Reactor proctector

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

168.119.242.255:7742

Unpacked files

SH256 hash:

ac94d7212fd6b954622378de380efd22692e81adae5a5008be511ad16fb7aea1

MD5 hash:

5d9c17d70e31669e028b73708e986146

SHA1 hash:

f039bebebe19e6e778d1d9b64408c3bfea079e11

Detections:

INDICATOR_EXE_Packed_DotNetReactor

Link:

https://www.unpac.me/results/a67f19f5-160e-416d-b791-5ae880077f6c/

SH256 hash:

a929b7cbf9bedd2aca719633dccaa39152e2eacc07cabd1cf39b59e6d0efec21

MD5 hash:

d3371ef1418084e4751d884bd291056b

SHA1 hash:

e1184095738d1c5f06b9b16697b38b7d84f62336

Detections:

INDICATOR_EXE_Packed_DotNetReactor

RedLine_Campaign_June2021

Link:

https://www.unpac.me/results/a67f19f5-160e-416d-b791-5ae880077f6c/

SH256 hash:

5e48183d2a6188eb120c836f15d6b6207212d684783ac6248bdf75318561a983

MD5 hash:

b8eecc418cfe9f5e23408e5b7823fefd

SHA1 hash:

dbeaeb1d8939885475df8a439168afb839009369

Detections:

redline

INDICATOR_EXE_Packed_DotNetReactor

Link:

https://www.unpac.me/results/a67f19f5-160e-416d-b791-5ae880077f6c/

SH256 hash:

9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a

MD5 hash:

5878d2c316a84469a950dabb79c668cd

SHA1 hash:

5dbd4dff21956f908697c0ffbc24c63d07eaa345

Detections:

MAL_Malware_Imphash_Mar23_1

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/a67f19f5-160e-416d-b791-5ae880077f6c/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9f852ecf47aa/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f852ecf47aa0ec1345f60f523f034e3b754f6a4b8b2ac7a40a5412446fc1f9a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/