MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a256cdcf68d1a64bdb3db85f88ec27da75a032f338d8740cffcbdf66b85f9d74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a256cdcf68d1a64bdb3db85f88ec27da75a032f338d8740cffcbdf66b85f9d74
SHA3-384 hash: 711305a31465d2c726cd8d717085cab71f6014d4e72654357ec4d1f4af59ec16b941248be851ffc18af62a4a0c30fac8
SHA1 hash: 4a930342a05d212ffbbd5926e46a72db6535b40f
MD5 hash: 34169ffd8ff8d920d8f7c9e80c3c6c87
humanhash: ohio-neptune-mirror-march
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'879'552 bytes
First seen:2023-10-02 17:31:39 UTC
Last seen:2023-10-05 09:16:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b77966559e48caa7890a2432200a2b65 (7 x RedLineStealer, 1 x LummaStealer)
ssdeep 24576:vqwDJXe9Dz+HV5bIUnygszbboMXDZgdi5wI13:v89Dz+Hf1nMwMTZgdC1
Threatray 393 similar samples on MalwareBazaar
TLSH T1D4959E6139804266EED3127646ECB514E36DE0F40B21C9CB67CB56EFDA2C2DE1A3D5C2
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc52355237_666459549?hash=4skpVnrWqIATOACAAICQzhzhmsqRVv61fUB3fz1zLtz&dl=6pu17BSQujz7kFLcWFlf1Z3R1s9HctD9j2hPN00XuRH&api=1&no_preview=1#fr

Intelligence

File Origin
# of uploads :
76
# of downloads :
296
Origin country :
US US
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/452725/
Detection(s):
Win.Packed.Pwsx-10008461-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a window
Unauthorized injection to a system process
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/651afe932d5fc006cad9aac9/reports/3469064d-498a-43e2-b2a0-28267afeff2a/overview
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/a256cdcf68d1a64bdb3db85f88ec27da75a032f338d8740cffcbdf66b85f9d74
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8503da3a-7b69-4320-9b7c-df39d0931422
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1318178
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a256cdcf68d1a64bdb3db85f88ec27da75a032f338d8740cffcbdf66b85f9d74/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-10-02 17:32:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 23 (91.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ujlm3t3i2gtexwz5xbpyr3bh3j22amxthdmhidh7zppwnoc7tv2a._file
Verdict:
malicious
Similar samples:
020c6da8f2bbd3a3f15dcbc8808255c2650df37f2b499b680e69d9e3cb1c1316
RedLineStealer
193b4c7d1fc068516bd8769e7c233afe88e165d9c5a783f5de0d98611d5c84c4
RedLineStealer
1d59250f90f7146e8181c11f7a731e381d22a07675aafeec48c46b7b0ae937df
RedLineStealer
21c16c4ece7acb14119e33f2bdd5ee40197fc43d0e93d9841c9a6c281a739cb5
RedLineStealer
370b12fd3dd8a9e65e3b8257072b6a79bfc17844d685496ad491b80dfc8adf27
RedLineStealer
5459835af56f5d5fd3bf0a3abb1cedc126a63c57eef8c0bcbd797366177a8f0d
RedLineStealer
7e93fa1eab66dd0436c705a8d5163e850d6e0a67374ca7aefb4c3cafd8145394
RedLineStealer
82ce3e2075a04b41fe2ba4551ae1e919e04986b64e470dccea4c5d6763722f0c
RedLineStealer
878a83f4a2cd78c095760cb7d79a46e11b2d33aba1d3281cd3b6e50ff509ffe5
RedLineStealer
d6702ffbfccb1f8aaa0e40c39a2257f0da03fdbff4b9aeb528156e316d6b0701
RedLineStealer
+ 383 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer
Link:
https://tria.ge/reports/231002-v397ladb9z/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
RedLine
RedLine payload
Unpacked files
SH256 hash:
f28567ccedf08c956f47650212f06724b58ce6fec2ed558f6fd54cb08c1114e4
MD5 hash:
cb94125773ef2ad6211c972e765991c3
SHA1 hash:
55e44a6d940e4a9849264cc55df5f12befa14f8a
Link:
https://www.unpac.me/results/ba1e077a-34d6-4d9a-a68a-8ef8794eb248/
Parent samples :
23b218e595cc1407a8bf940048ae120061ef7dafb7240d5d313a2c22a3548d0e
8e935ee77cd8dc1bb7cab60d201990612915fcc88659165b10743dede5f3cd9f
cf254832f21bb77a35543ce4e9a0871ff448205a35cd572300d0e3dbd0049e14
38b4eb0297b4005fc4f8c240712d6209d791788adfef0dcf93ad525e6314b20d
6e5db63bde4b8327ef0c85e7a17f3bafff3447496711dfcfc14c4da023000158
dbb7984df83f7a7bf7dd3335d963839f9dec74fc7cb83cea840ec2141949cf46
SH256 hash:
a256cdcf68d1a64bdb3db85f88ec27da75a032f338d8740cffcbdf66b85f9d74
MD5 hash:
34169ffd8ff8d920d8f7c9e80c3c6c87
SHA1 hash:
4a930342a05d212ffbbd5926e46a72db6535b40f
Link:
https://www.unpac.me/results/ba1e077a-34d6-4d9a-a68a-8ef8794eb248/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a256cdcf68d1a64bdb3db85f88ec27da75a032f338d8740cffcbdf66b85f9d74

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer_2
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_redline_stealer_bytecodes_sep_203
Create hunting rule
Author:Matthew @embee_research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/452725/

Comments