MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a987c49f8534d3b19224a85d30ca278e822a3e57829bc9212dcdc38673ca6ac9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	a987c49f8534d3b19224a85d30ca278e822a3e57829bc9212dcdc38673ca6ac9
SHA3-384 hash:	d478fbe764358dbe428a3688932a61ba9ae6337b3e4c7c3c66204430c1a8a4d33a752aeb513f150f6aa5eb78834eb4d3
SHA1 hash:	eedcdcc9ec3f520d935626974ff012887136fc7f
MD5 hash:	2b1877727ba1b22be5199c315e805873
humanhash:	oranges-bacon-december-salami
File name:	2b1877727ba1b22be5199c315e805873
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	435'712 bytes
First seen:	2022-07-15 03:22:53 UTC
Last seen:	2024-07-24 20:05:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	66bf435feaaa12e148aa302420048fbf (7 x Smoke Loader, 5 x RedLineStealer, 1 x Amadey)
ssdeep	12288:enhZR9RYQaq2l39l3jtK/UXJFRzjc7a3XgPI:ezRROlv3xKM9jc7
Threatray	3'922 similar samples on MalwareBazaar
TLSH	T1B494CF00B6A0D435F5B713F449B6836CB92E7EE1AB2050CF62D52AEE5A346E4EC31747
TrID	40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 17.0% (.SCR) Windows screen saver (13101/52/3) 13.6% (.EXE) Win64 Executable (generic) (10523/12/4) 8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	72c5a68eaea7d670 (1 x RedLineStealer)
Reporter	openctibr
Tags:	exe OpenCTI.BR RedLineStealer Sandboxed

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

2b1877727ba1b22be5199c315e805873

Verdict:

Malicious activity

Analysis date:

2022-07-15 05:40:36 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/90ac4010-7ab9-400b-b16d-bf71f0df465f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/289277/

Detection(s):

Win.Packed.Crypterx-9954995-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Sending a TCP request to an infection source

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/25178/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/62d0dd9ad6d93426ceefe8c6/reports/8c459672-edca-4b9c-8070-b2a114395b5c/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fa104bac-2469-4904-9cfc-edadb60ba0e5

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1032258

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Generic Downloader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a987c49f8534d3b19224a85d30ca278e822a3e57829bc9212dcdc38673ca6ac9/

Threat name:

Win32.Trojan.MintZard

Status:

Malicious

First seen:

2022-07-14 06:33:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

32 of 41 (78.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vgd4jh4fgtj3derevbotbsrhr2bcupsxqkn4sijnzxbym46knleq._file

Verdict:

malicious

RedLineStealer

0d0be8ecc5e7c7d3fb48665b5860aa8eb97d367f58af0de01e8bcff3861f4c52

RedLineStealer

2ddb7e26178785246bef1ba34dfef42e26ce9eea5dffed088ccd652981af87b1

RedLineStealer

717a7bc855bf0e7a41ac02b8206308d7708446296ee5459ff1afe8deb09334db

RedLineStealer

7981f4ab78429b04690814bd41fa055a25681fbe1dcbde4658c9a454eb1fad06

RedLineStealer

8378943cc1fc7dce14da429d958494f07d088a1195cadba0e3fe4cd89af1a5f6

RedLineStealer

924b15ca611c0b85c395f09df87cec39057bd3e3e23d0528cb39d5c694fc566d

RedLineStealer

a5fc2adafff6188a61aca081ba51c752f85cdb38a8330a576fdf46d84884a2ac

RedLineStealer

a8c61f07f150b304910048c35cbc17e44707f3a0f779f527db8f03a3b6ed48d5

RedLineStealer

b306c0fb59c1448720fdc9cf0c44aa22f074405c481f61a04a652572dd4c07cb

RedLineStealer

+ 3'912 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:rz discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220715-dxhfysdban/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Malware Config

C2 Extraction:

193.106.191.81:23196

Unpacked files

SH256 hash:

505738123de9a542a7f694e91849f2e704ad95b0760d6e8dbdf40970e065fda2

MD5 hash:

83e632d6b9cbd8eb169a5d6ae7d857fc

SHA1 hash:

eaf1cddc13d67e7cea190ff0897c2d99833df24d

Link:

https://www.unpac.me/results/ef306fcd-ab8f-405a-bae8-14567fe385ed/

SH256 hash:

b1f67ddd835e347f140ed1fc675a40a1302cb97720fc899d3742ed6010fd1c0b

MD5 hash:

d564c0dc17855d40dc9e1ff637e812ef

SHA1 hash:

cbcead5cfc862b6211c5613354b93011bea9a25e

Link:

https://www.unpac.me/results/ef306fcd-ab8f-405a-bae8-14567fe385ed/

SH256 hash:

edde14647f053f01c8e71bedb920ae509e52cc2b6ad42d88432dfc474b39b70b

MD5 hash:

83d717770a9facb5836c432bd21ab479

SHA1 hash:

5ef54e42263061f96c10537121d0c15b5f8f4436

Link:

https://www.unpac.me/results/ef306fcd-ab8f-405a-bae8-14567fe385ed/

SH256 hash:

a987c49f8534d3b19224a85d30ca278e822a3e57829bc9212dcdc38673ca6ac9

MD5 hash:

2b1877727ba1b22be5199c315e805873

SHA1 hash:

eedcdcc9ec3f520d935626974ff012887136fc7f

Link:

https://www.unpac.me/results/ef306fcd-ab8f-405a-bae8-14567fe385ed/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a987c49f8534/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a987c49f8534d3b19224a85d30ca278e822a3e57829bc9212dcdc38673ca6ac9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.