MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1
SHA3-384 hash:	1002c7d562ebba5dbb7863f739245cd1aa4e99bd56ee533d6026b7304805cad1716ff5ffce2880ab60ba43a1ce2ae805
SHA1 hash:	0578d7f0ccba7de5d3c2d377a9ce8a60c3374b97
MD5 hash:	01f11becd5171d04262e3e3d5545ea63
humanhash:	vegan-lima-cola-skylark
File name:	01f11becd5171d04262e3e3d5545ea63.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	589'824 bytes
First seen:	2021-07-19 15:35:28 UTC
Last seen:	2021-07-19 16:46:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	52c37101f2973085af5ed972e3b0d2d3 (7 x RaccoonStealer, 1 x RedLineStealer, 1 x DanaBot)
ssdeep	12288:babr0tmo0vfl+QIhiXTujWjsHEYRxn/JHDttKl+4cfyeVP:b8wtzWYQfTujCYDn/JHvfycP
Threatray	1'436 similar samples on MalwareBazaar
TLSH	T13CC4121074E1CA22E6E2923554F6C6E16A3FFC262969598B33F036DF2F705D2693D312
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

01f11becd5171d04262e3e3d5545ea63.exe

Verdict:

Malicious activity

Analysis date:

2021-07-19 15:49:31 UTC

Tags:

evasion loader

Link:

https://app.any.run/tasks/033bd276-6065-4fa0-a686-491a0137c678

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLineDropperAHK

Link:

https://www.capesandbox.com/analysis/172594/

Detection(s):

SecuriteInfo.com.Trojan.Siggen14.43374.2266.10880.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8ac7aa95-9ae0-4c84-a660-a30da4c3b1b2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

spre.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/818395

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Uses known network protocols on non-standard ports

Yara detected Autohotkey Downloader Generic

Yara detected Evader

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-07-19 01:22:01 UTC

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vogfngdj7yx3wzpjc6qw3euufan3buesqvvd6ekp6hxeouhvthqq._file

Verdict:

malicious

RedLineStealer

12155a842ef95b7c5e481c325508c0cc43bba8128174c548cd72b67f12a97362

RedLineStealer

25cf264589639fc27c6dc012e33e5fa8054add3915d9265e934d849f763e5b51

RedLineStealer

49e784cd4664d480317bc3e726821d153e14ebc8b335cebce963ec427e4dcea9

RedLineStealer

9cda98989c3b49da5566c23722e52231ecf25934e12e81c09bc845312f6a86d9

RedLineStealer

a4ba89389929db2c9baa52e9b858164dad161d53ba61a73712a2c3ba92b49ec5

RedLineStealer

b138c67994648f1784c8263e0af703662e2bd8e55d9d8a1189dcf243f2bff657

RedLineStealer

bdae4240709c06d733b9d67851a9d5f159102d145ab7f57ab689358a196916bf

RedLineStealer

f77ee607590d0eea0340f732222a78f3ffdb990c45796075071b051aeb83afbe

RedLineStealer

+ 1'426 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:19.07 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210719-34n6sejzax/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.215.113.15:61506

Unpacked files

SH256 hash:

125bbed66ff7c6535590bbd2341f0e3e8394391a9263ffcf3c07ae043a81fa30

MD5 hash:

a75968486cddabd6a3e9a191cf0c4d24

SHA1 hash:

64143e8e7a57bd47b83d79a431e4914bf146a8c7

Link:

https://www.unpac.me/results/0b39b466-841f-4a6b-8708-c0dc4e9c8267/

SH256 hash:

ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1

MD5 hash:

01f11becd5171d04262e3e3d5545ea63

SHA1 hash:

0578d7f0ccba7de5d3c2d377a9ce8a60c3374b97

Link:

https://www.unpac.me/results/0b39b466-841f-4a6b-8708-c0dc4e9c8267/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.