MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 1 File information Comments

SHA256 hash:	a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e
SHA3-384 hash:	b471ca7f0fed1153f773d1e44c27fb5b6035bbc658fc623c97c6099e27f240b6905e4762311a3de2dea1c918e4f26a91
SHA1 hash:	9e70c64be6657f8b079e5929ba0b568664c4680c
MD5 hash:	b76efe08c80977c7f06c25a6cbcee520
humanhash:	two-arizona-hotel-montana
File name:	SecuriteInfo.com.W32.Kryptik.ICN.gen.Eldorado.25463.27103
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	324'608 bytes
First seen:	2022-11-25 02:29:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2d129e25454562ff3cc878ef0dbc787a (5 x Smoke Loader, 3 x RedLineStealer, 1 x TeamBot)
ssdeep	6144:yHvYLLzG+kfkCgMxRtyzRCZzquZb26b2EAkrrLWV35Dr8IB:yHvYL3G+kcXM8RCBqgb26DXLWRx
TLSH	T18E6401327A90F032C95A1D305814DBA4AA7D743129B8869B779C07FD1FB8BD1A739387
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	25a41378319b9b91 (6 x Amadey, 5 x Smoke Loader, 3 x Tofsee)
Reporter	SecuriteInfoCom
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

435

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

SecuriteInfo.com.W32.Kryptik.ICN.gen.Eldorado.25463.27103

Verdict:

Malicious activity

Analysis date:

2022-11-25 02:30:25 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/aad20e14-7db0-46d1-9fd6-cc8e219e7074

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/338249/

Detection(s):

SecuriteInfo.com.W32.Kryptik.ICN.gen.Eldorado.25463.27103.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/638028ad94f9bac087b34688/reports/4f919544-a866-4aad-89a4-66b47177bc88/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/69f0a7bc-5617-445f-9520-448b9fcc88bb

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1120818

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2022-11-25 00:40:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ugroak367zt4wsdf6v2rcxyz6krg2qod4ag2owauylfktpshub7a._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:newyear2023 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/221125-cy6dqseg25/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

185.106.92.111:2510

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3eef17fd-3cc0-493f-9fcc-c6d059e6783a

Unpacked files

SH256 hash:

faea5fe023883dcfd6027c26979ede9a2a647a0cafdfe61a1c001b0b0840f52c

MD5 hash:

2189544d945430f59f0435e5279e83e3

SHA1 hash:

bd7e8e02bd301de7d64a9d3aa19b24a75dbe7ea2

Detections:

redline

Link:

https://www.unpac.me/results/6f97f35d-49ca-407e-afd1-489af03b8dfd/

Parent samples :

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a
a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e
91a8f365008dfc8e9fab751f78472882c1cfacb909b290900fd2788cb9feeb6b
2a89f391b53ed6f4ff5c29efee712d7f56fe531e04db633df67d0d5d28907609

SH256 hash:

41e7b1a4320cb36f0b8677c05070c96dc4b64d9a3c4092cf8be5cdab48050036

MD5 hash:

cca2b26ae49f850e44c57c9a010b0e8e

SHA1 hash:

495a3751ef969b44e9ef61382adf9747d79eb221

Link:

https://www.unpac.me/results/6f97f35d-49ca-407e-afd1-489af03b8dfd/

SH256 hash:

b7fbdfef210e41b4eb488a9d53da2ddd9383d6ee276004a4338c45717a15ab12

MD5 hash:

c670aa7f7beade472935285c4fa82b67

SHA1 hash:

44d1e023ad422fc34ecdfd1d896f7132c47aaf4f

Detections:

redline

Link:

https://www.unpac.me/results/6f97f35d-49ca-407e-afd1-489af03b8dfd/

Parent samples :

6792bd35a4de116b29f3c10fc30e74f28d3437eb58a98def8c037261b104c94a
a651001136d322283e08a68956eb21ccc97d37a92dbf9635be65d02f340cd825
789c04095a1668ff380d54c82d30303a95a2341451e8cae4b3db93e577bccb89
a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e
91a8f365008dfc8e9fab751f78472882c1cfacb909b290900fd2788cb9feeb6b
2a89f391b53ed6f4ff5c29efee712d7f56fe531e04db633df67d0d5d28907609
b85f9751c2d8e61f1c9a9bbdfa5702aae5f94204ef4f03537acbb13be9d08178

SH256 hash:

a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e

MD5 hash:

b76efe08c80977c7f06c25a6cbcee520

SHA1 hash:

9e70c64be6657f8b079e5929ba0b568664c4680c

Link:

https://www.unpac.me/results/6f97f35d-49ca-407e-afd1-489af03b8dfd/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a1a2e02b7efe/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a1a2e02b7efe67cb4865f575115f19f2a26d41c3e00da75814c2caa9be47a07e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.