MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8
SHA3-384 hash: 27ffea3b25c2e55ac6272099ab656457bae568d804df199f4281385bf0f9bca558e3f4dbc0a35c1f651ee82578054cf7
SHA1 hash: f560421dd3273920f8cacb591fe0a1d41bcd5b13
MD5 hash: 9ccbeddfc2ca1e15fb2d2ff4b2981446
humanhash: kitten-video-arizona-johnny
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:367'616 bytes
First seen:2022-10-21 22:11:06 UTC
Last seen:2022-10-21 22:49:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bc5a05e947eb61731a4e3024a4f4b617 (7 x Smoke Loader, 5 x RedLineStealer, 4 x Tofsee)
ssdeep 6144:9RNLRVBAed7vzCjPK9WA9efiFPRg2NN85CmCuOBC1l+H+QKvuS:9RNtVeelLmCD22XUauD+H+Q
Threatray 8'222 similar samples on MalwareBazaar
TLSH T1D2740120BD83D4B2C58685364860EBA495FFFAB2213116577B547BEE7E302D35A7230B
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 0b168c4aa6da7233 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://91.212.166.11/MicrosoftKey.exe

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.212.166.11:47242 https://threatfox.abuse.ch/ioc/915786/

Intelligence

File Origin
# of uploads :
17
# of downloads :
335
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-10-21 22:11:33 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/4497b456-bcec-41c3-87fc-bb34745c385e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/322423/
Detection(s):
SecuriteInfo.com.Variant.Babar.111863.15001.13340.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the system32 subdirectories
Creating a file
Reading critical registry keys
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63531933fdf6478a15afb6ec/reports/1f7a62fe-ffeb-4b50-8d0a-3bb8af73680d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/759cf9e4-d3d4-4d99-a022-3b7884d85dc7
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1095198
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-21 23:13:19 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u6xfxllyvmjuzsxwrboais2pa2d32acfhi5oje2ebsfkwghyjkua._file
Verdict:
malicious
Similar samples:
01b395ef1e98098a35ab3d84e6189a863a3408ba87ebff065e30e9cd81e6fe72
RedLineStealer
1e120fcdb2d771ee3a1b169b5aab47a4321f8bd42688819e9e030cbbc8b9a88d
RedLineStealer
39df945a201a8891a98e8da9eca61390aea99e913a05451a1c98a5a934fa3346
RedLineStealer
9b3c936ca4fe043d2de3842d446c5030d0053e8ac21c09b5ccf4a3eeda12b745
RedLineStealer
bf10c7c4d99a0f38392a9aaa8f594015ab263f8720ab84b586cf5d9887a38cf0
RedLineStealer
c62fad628cdc4b12c1ed5ff5dce30eb27637b8de6d33ef58ce039f5f7328d88a
RedLineStealer
d3b41afb03798c53bea9cc1f592438556c83a570526930a7b3025a7bcccd15d1
RedLineStealer
edcc696b6fce95520e5018fc8cf00041f813ed4ea4d4244c2215b9abd2265939
RedLineStealer
f5b5010846f8b9d120cafe1f08ecea43ed3db53cce2c4e4bf166c67dd15bb183
RedLineStealer
+ 8'212 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221021-14g54ahdhq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
91.212.166.11:47242
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/17e5481f-5bd3-4868-9a76-8449c8fe9f31
Unpacked files
SH256 hash:
7aeaed85e776d5c0b90f88198967f3899a966cd5082450c16a6193f7291a5785
MD5 hash:
37e42fb7addce313070a2b7d046649d0
SHA1 hash:
ee841e10c97511ff454c618932e8addef435f64f
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/46056a4f-860e-4952-a79e-bca649d44946/
Parent samples :
f5b5010846f8b9d120cafe1f08ecea43ed3db53cce2c4e4bf166c67dd15bb183
d3b41afb03798c53bea9cc1f592438556c83a570526930a7b3025a7bcccd15d1
c62fad628cdc4b12c1ed5ff5dce30eb27637b8de6d33ef58ce039f5f7328d88a
39df945a201a8891a98e8da9eca61390aea99e913a05451a1c98a5a934fa3346
edcc696b6fce95520e5018fc8cf00041f813ed4ea4d4244c2215b9abd2265939
bf10c7c4d99a0f38392a9aaa8f594015ab263f8720ab84b586cf5d9887a38cf0
9b3c936ca4fe043d2de3842d446c5030d0053e8ac21c09b5ccf4a3eeda12b745
1e120fcdb2d771ee3a1b169b5aab47a4321f8bd42688819e9e030cbbc8b9a88d
01b395ef1e98098a35ab3d84e6189a863a3408ba87ebff065e30e9cd81e6fe72
a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8
2fd4e12ca05b5c792920ebfc3d54526ff279f70a64408c536ec0299fe1025613
c1bf9f51139db8a6617de3f172899299370bdd49aad7e506f3e02a02bec50f1d
81ef289117db84443107cf4deb77e628dd21b97fedb506f344841512f5b526ab
032ce3464e8a92d8e0a5d6bfc8896789d84f24cb966a0671c3853194425e52a8
846b7a60f9d99196a1eca6e57afc9acec172148a47c659181ccbca5008cfc59f
28b49914253e8f8bf0e0e929c58ffbd6106909bccd89e48352f22fe8dddd1c15
107068a801467832323ad97adc3b4d8ab8d00b29da196fd19b3ac1cc1e690b83
40a3870bdcbdf795698e3a3c59da48ecefb690d21133d8161d5c49cf9098883d
c77944ea95eb21d06f1711c77382d8fb2cd56a6bcae5dfec2ad0cc552e2a63fc
ed39d25e303df1b878b1e5206b658dc4416d117bc8aa8c095e602a0823b0495c
3ec42054dcc224efb3f45082267dcbf79a26b087b74413bf53b9acc0747fb937
fe6ef84de0f934dd79b0d2af5a3317275eedd2343d3024f8a095daa925add9eb
5aba1e0c883575e2642024a6642b82ca86ec000c657937f8bbf87927b71d4c60
b6a78c8a972f088a27b29ce01cf9fd77a3a731d2bf4db965ec5af7a3bb38e0c5
bc128ad5247f40fb466fb6e62c35f61c65c1c8e640fe0af67aa9710600871fc4
36ea7e21b2d8f6fca431a0f549ce4de96ff5f6cc3ded1d4edf1699c0a2dcf9b6
61cfe71dbd5c277f07091977f99427156ac066c664534b9345334bb9d2aa657a
8913c4b3be9afa554dc51de489cfba651edfda580c5740c859d482e81e7df3d4
SH256 hash:
2d94eec869cd0b448eb3ad3d16679383549f3230f9963e92d1f43450824fc25f
MD5 hash:
19c88386fa430cb2754902fc6c1e287e
SHA1 hash:
94d488d6d65e3694e905d159f6c80889389e4058
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/46056a4f-860e-4952-a79e-bca649d44946/
Parent samples :
d3b41afb03798c53bea9cc1f592438556c83a570526930a7b3025a7bcccd15d1
c62fad628cdc4b12c1ed5ff5dce30eb27637b8de6d33ef58ce039f5f7328d88a
edcc696b6fce95520e5018fc8cf00041f813ed4ea4d4244c2215b9abd2265939
bf10c7c4d99a0f38392a9aaa8f594015ab263f8720ab84b586cf5d9887a38cf0
01b395ef1e98098a35ab3d84e6189a863a3408ba87ebff065e30e9cd81e6fe72
a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8
2fd4e12ca05b5c792920ebfc3d54526ff279f70a64408c536ec0299fe1025613
81ef289117db84443107cf4deb77e628dd21b97fedb506f344841512f5b526ab
107068a801467832323ad97adc3b4d8ab8d00b29da196fd19b3ac1cc1e690b83
c77944ea95eb21d06f1711c77382d8fb2cd56a6bcae5dfec2ad0cc552e2a63fc
36ea7e21b2d8f6fca431a0f549ce4de96ff5f6cc3ded1d4edf1699c0a2dcf9b6
SH256 hash:
04b8fb9f1dfd24687f353a19875642cfefd7a3f611ab2d6a0c7df7ee77481ea5
MD5 hash:
c41bc7d2bacad07a0154c7759d5835bf
SHA1 hash:
6dba29b3561a6791487ff0db967a2b077d010606
Link:
https://www.unpac.me/results/46056a4f-860e-4952-a79e-bca649d44946/
SH256 hash:
a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8
MD5 hash:
9ccbeddfc2ca1e15fb2d2ff4b2981446
SHA1 hash:
f560421dd3273920f8cacb591fe0a1d41bcd5b13
Link:
https://www.unpac.me/results/46056a4f-860e-4952-a79e-bca649d44946/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a7ae5bad78ab/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7ae5bad78ab134ccaf6885c044b4f0687bd00453a3ae493440c8aab18f84aa8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/322423/
  
URLhaus
https://urlhaus.abuse.ch/url/2381563/

Comments