MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5
SHA3-384 hash: 9ddcc6110d03b5296ea7719a0df329554fea24095b547c798f2136292b461b4e938f4ea8a2361b76f8d1250d1166f787
SHA1 hash: 102ca96b1feb4fc48ac4dc334ff39d1df56b6b92
MD5 hash: f6e4fc7baa78faf7df81e7b2cdc6a0e3
humanhash: lithium-maryland-magazine-eighteen
File name:f6e4fc7baa78faf7df81e7b2cdc6a0e3.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:468'992 bytes
First seen:2024-02-19 06:38:38 UTC
Last seen:2024-02-19 08:31:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b77b99c3883f50fc5eeab54139139034 (4 x LummaStealer, 2 x RedLineStealer, 1 x Stealc)
ssdeep 6144:IA7NA8CCboHeDdZw3nLvPh1OMv1HR5OijmrOlepwyL477JYN55UbUwt:IA7NA8GLHTOARDHl+fS
TLSH T115A4BFB0BCBDF02CCF3289F256637E184A2D00BB8D33A517197855EB5974F916723A29
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
371
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/476716/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.23643.19409.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65d2f78926f1ddc579a0018f/reports/772562f2-1975-4dd3-84b7-7fff6699f912/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3205f5c1-8bc1-401c-b802-02f22417bece
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1394285
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-02-18 23:33:22 UTC
File Type:
PE (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ullrehlbpm2c6kbjs3y7wgdtopyj2jcoojbc4zvlhtbdqnn7f32q._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@magic_dad discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240219-hel4msaf51/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
147.45.47.100:24854
Unpacked files
SH256 hash:
6f65dbcafc9b14e879ebf84d5b587124f7f1a217130a1514da7a183f86d82cbf
MD5 hash:
cdd06dccd3b8b871cc157f3ba568e3ea
SHA1 hash:
61cc54a99cece55e38577cf7ff282f080c574a04
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/47bc72c7-cc22-4019-b103-fa5130776a33/
SH256 hash:
a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5
MD5 hash:
f6e4fc7baa78faf7df81e7b2cdc6a0e3
SHA1 hash:
102ca96b1feb4fc48ac4dc334ff39d1df56b6b92
Link:
https://www.unpac.me/results/47bc72c7-cc22-4019-b103-fa5130776a33/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a2d7121d617b342f282996f1fb187373f09d244e72422e66ab3cc23835bf2ef5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/476716/

Comments