MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a10d82b52187d90d7046806ce0e24997b192d9862bbe843869a4046f1c5fe926. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a10d82b52187d90d7046806ce0e24997b192d9862bbe843869a4046f1c5fe926
SHA3-384 hash: 91966b31f0285892b20916a84251688f100789d5329c55f6f11c8007c111cde22f1126d400b0ad7001eaf16c0ee61782
SHA1 hash: 91419caa6f9b93ca3c2534139b11990d54d4ff15
MD5 hash: cf0c657e28a3897d9a1a87f3c0605282
humanhash: utah-apart-golf-colorado
File name:cf0c657e28a3897d9a1a87f3c0605282.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:860'264 bytes
First seen:2021-10-05 06:36:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:9mJ8VU+0YBmXJHbPJDpo0HkWSDbfjpODvvIYKVm5qxKwGa+U3+HHKKaIo:9mX+9BmXxBDpoPjmnKVYq4wE+axno
Threatray 2'165 similar samples on MalwareBazaar
TLSH T17B05E005F7C28A42CFDD5A75C4970C600AF5EE9ABA67E3983B24F5787663331450A2CE
File icon (PE):PE icon
dhash icon 92e0b09ee6dada62 (10 x RedLineStealer, 3 x CoinMiner, 2 x DCRat)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.125.217.52:8771

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.125.217.52:8771 https://threatfox.abuse.ch/ioc/230448/

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
OneTapV4.exe
Verdict:
Malicious activity
Analysis date:
2021-10-02 07:02:51 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/ec9759a4-fb39-463e-a146-a0ac31159f58

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/194884/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
keylogger obfuscated overlay packed
Link:
https://www.filescan.io/uploads/615c0675e3d213d202b76e14/reports/c3c46b3c-76ac-4bd2-a18d-e5415de5f03c/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/720ec8b2-f941-422e-aed4-3ed8d1060138
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/864489
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 496917 Sample: GVC5hr3PFN.exe Startdate: 05/10/2021 Architecture: WINDOWS Score: 92 29 Found malware configuration 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected RedLine Stealer 2->33 35 4 other signatures 2->35 7 GVC5hr3PFN.exe 4 2->7         started        process3 dnsIp4 25 192.168.2.1 unknown unknown 7->25 23 C:\Users\user\AppData\...behaviorgraphVC5hr3PFN.exe.log, ASCII 7->23 dropped 37 Adds a directory exclusion to Windows Defender 7->37 39 Injects a PE file into a foreign processes 7->39 12 GVC5hr3PFN.exe 3 7->12         started        15 powershell.exe 25 7->15         started        17 GVC5hr3PFN.exe 7->17         started        file5 signatures6 process7 dnsIp8 27 185.125.217.52, 49756, 49759, 49760 IHOR-ASRU Russian Federation 12->27 19 conhost.exe 12->19         started        21 conhost.exe 15->21         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a10d82b52187d90d7046806ce0e24997b192d9862bbe843869a4046f1c5fe926/
Threat name:
ByteCode-MSIL.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2021-10-01 12:35:01 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uegyfnjbq7mq24cgqbwobysjs6yzfwmgfo7iiodjuqcg6hc75eta._file
Verdict:
malicious
Similar samples:
0fb73b5a78afbb7675fcf2e772b1f2c45bb5791973434c2edd18539f611b93c6
RedLineStealer
1eb3574e7faa18d12759034dcc5a26ac90d79badef17cf1a744854d9a9e41cb0
RedLineStealer
52c8b2a76e11b6fab2913cde02aca252462f61a89e0436815e272fc74f0137ec
RedLineStealer
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96
RedLineStealer
830b27683258b9f669a465aa971db78884f34dbe8d6fd261a4eae6e850b88c43
RedLineStealer
9b219f917b2990b8e0ab9a60f9d7b61c281dbef457b20c2b0a1e5e8b1989d74c
RedLineStealer
a4ffe5148767a4349cc43b105357623c0a47f64433a55d0aaed63f3a2a3e4493
RedLineStealer
b5b8be0cd8c49e313fb626534cc7d705ef7591184753faaddcd87e0f74a2cac1
RedLineStealer
d1653b5cbbf61f3666ac0c5ac308b75d0d0c5029941ca9efbf37f18b51f9a3a6
RedLineStealer
e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3
RedLineStealer
+ 2'155 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:289 infostealer
Link:
https://tria.ge/reports/211005-hdgsjahfcn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.125.217.52:8771
Unpacked files
SH256 hash:
37037cfc1f9460d358c4ca996dc777b165b092b5f718165c1342664a78b228a4
MD5 hash:
cf3cbeae797497f3236f6115fd4f9f55
SHA1 hash:
b5c6c55fdad0f23e326018d44289af2fad1c6c91
Link:
https://www.unpac.me/results/f2c081a3-7552-4238-b1c0-dea0c6220638/
SH256 hash:
1a2041dabbdb3f7d8fdeada97e92858b2956b9c11d232669d0b976bf0b2ae910
MD5 hash:
7a74cd25575c008f03fe286e919dde94
SHA1 hash:
6851438000153e1c28cef13e305dada365d56f79
Link:
https://www.unpac.me/results/f2c081a3-7552-4238-b1c0-dea0c6220638/
SH256 hash:
d6b7f79fb27d8013d29bbab35d293cba54ee15594ff844cd5395bdaed37e8b32
MD5 hash:
d650480adbb2e0597428880e6dde04b4
SHA1 hash:
3860bdca8140c74ced76b562772a5092e4879091
Link:
https://www.unpac.me/results/f2c081a3-7552-4238-b1c0-dea0c6220638/
SH256 hash:
6a671abf66304301602b4afd0902840bc3915455cffc58d8916eaa693abe33ec
MD5 hash:
681eca96e4e7b513317178dc7065ef39
SHA1 hash:
24af82015bc57d125f1ccb759840118b2283d1dc
Link:
https://www.unpac.me/results/f2c081a3-7552-4238-b1c0-dea0c6220638/
SH256 hash:
a10d82b52187d90d7046806ce0e24997b192d9862bbe843869a4046f1c5fe926
MD5 hash:
cf0c657e28a3897d9a1a87f3c0605282
SHA1 hash:
91419caa6f9b93ca3c2534139b11990d54d4ff15
Link:
https://www.unpac.me/results/f2c081a3-7552-4238-b1c0-dea0c6220638/
Malware family:
RedLine.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a10d82b52187/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a10d82b52187d90d7046806ce0e24997b192d9862bbe843869a4046f1c5fe926

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/194884/

Comments