MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 11 File information Comments

SHA256 hash:	a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c
SHA3-384 hash:	8f1137c5f9dd4c32b59549d153c69cd51338c931c58f55ee2e901d4108bc1f981e5358cbadcd83934630bed4b31e610c
SHA1 hash:	b619982e5003ba5b3f64ae4f1661b00030e43ca0
MD5 hash:	14a7013b921ea42e4192b57f2ce43c32
humanhash:	winner-alabama-mango-oven
File name:	file
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	387'840 bytes
First seen:	2023-09-23 08:46:58 UTC
Last seen:	2023-09-23 14:43:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	dc563239367bde3bd3527a2dc91eeac9 (6 x RedLineStealer, 1 x MysticStealer, 1 x N-W0rm)
ssdeep	6144:ffLX/pgd2f0gqLDfn5AOV4qKdayTp8KuJcFhLHDkWCKXZNMNuB3NkA6QmCnVRxoC:fD/pNC5/oDp8KuJcFhLHbTd9kJHCnVRp
Threatray	1'010 similar samples on MalwareBazaar
TLSH	T1CB848DF136DB5229D06B523376CC89ED3DBDB4210B27F49BE378CB297958065E62081B
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	andretavare5
Tags:	exe RedLineStealer

andretavare5

Sample downloaded from https://vk.com/doc52355237_666036259?hash=OBiDI0zFvCmVYmLdF8pIEbmTUTJrHslBXqp8BbKBoPL&dl=oEZzzcypnQZ2tLENzmGmmgIX7Zs0DlI1Y9QY2CEsjO4&api=1&no_preview=1#1

Intelligence

File Origin

# of uploads :

# of downloads :

272

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-09-23 08:49:29 UTC

Tags:

stealer redline

Link:

https://app.any.run/tasks/5cd957b3-d882-44d2-8067-b0583960990a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/450710/

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.29625.7387.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Forced shutdown of a system process

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control greyware lolbin overlay packed

Link:

https://www.filescan.io/uploads/650ea608f1b40cb0d62114a9/reports/365efef5-7883-42b2-bd39-056361294dfa/overview

Verdict:

Malicious

Labled as:

TrojanS.F23C58EC

Link:

https://www.hybrid-analysis.com/sample/a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bfd2d651-926e-42bb-9415-6474d92f4b91

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1313229

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c/

Threat name:

Win32.Spyware.TrickBot

Status:

Malicious

First seen:

2023-09-22 18:30:03 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vbzsy5si2rrit4eedc7zlidwsh2n6nalh6trch5rw6rr23cdciwa._file

Verdict:

malicious

RedLineStealer

2de6754a429fb1bf67e370615ec3c27d10ff20749b3df395c16726e964f4ae72

RedLineStealer

5dbcbe8d4b6db423e7b0da0991367f085d8bf89cd067501fe9600571ff9598ef

RedLineStealer

7b22e6cc31710809bbb88f27afa15ad45784dd0ccd3da27be9b6ca3b039a15ce

RedLineStealer

845321e0072b6a37c502b6f5992d8e750ac254c3b09c9e55874722fae5ba87d4

RedLineStealer

8df6ff949de778a20deb98bd90e21d9e9449045b73f75cd62c051957997882bb

RedLineStealer

9f78f23917333e4e4ee095e36f159d24d29117296c458b748831d4c0ede6b938

RedLineStealer

bb1b75ca2b1cf87a535caf84537badae8ea32f9565c45a8eb955002d708cf258

RedLineStealer

c1d088856f128aa9dbd120f2a727fbb33ae1567caf85d612426345d5e34545eb

RedLineStealer

d2f6db105fe997f60739a7b253dc4d863d35a41105c36bfd16a7a26a5a37b808

RedLineStealer

+ 1'000 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:logsdiller cloud (telegram: @logsdillabot) infostealer spyware

Link:

https://tria.ge/reports/230923-kpv6eaga36/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

Malware Config

C2 Extraction:

51.38.95.107:42494

Unpacked files

SH256 hash:

20fef2001f5c8fcb55f3667939d79c658d60ebcad105e2392d4fb857d63ac1d3

MD5 hash:

ec5d226f35ccca691d342d8042b9c145

SHA1 hash:

fbdafabc34fd52e529de91aed67fbb2c9e868f3c

Detections:

redline

Link:

https://www.unpac.me/results/e64f35de-1491-422f-8fd5-a065780f3ab8/

Parent samples :

05fa5ba961ff9960246bda66800278d3c057ef86f4cf0c8b2ab299f1d0e9ef42
ca01887f1261ab5d83adc154e7875e2a34916f93771c13a056bda75ee17a07ca
cccc9e44afb3839868c474e6e4942f0a359861c5322c6a9fe1ebd9ba79175b00
42df844a60c2121d9e334a9fed2b21653adba1766f4a552e747d41917e12fa78
c5e390a99b5e24664a62ee6f36778d439bdfebb7729d7862a63b61e344babceb
188c63d9c2fc36af2a1e2e3fb808420c14e79fd0efffba7f6430535e1008f17c
ed311e8496352c740680e63bb9fd2445f8432a4ca8d47637f37e3588dc475591
a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c
70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a
0c2b53fe884a1527b856d6ae76dbee8d160797c78cbcf8641bdfa66328879ba6

SH256 hash:

a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c

MD5 hash:

14a7013b921ea42e4192b57f2ce43c32

SHA1 hash:

b619982e5003ba5b3f64ae4f1661b00030e43ca0

Link:

https://www.unpac.me/results/e64f35de-1491-422f-8fd5-a065780f3ab8/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a8732c7648d4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a8732c7648d46289f08418bf95a07691f4df340b3fa7111fb1b7a31d6c43122c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dropped by

PrivateLoader

Delivery method

Distributed via drive-by

Cape

https://www.capesandbox.com/analysis/450710/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample