MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af90b7982f9e83491575881365351306991619644e94fde6382d892f27a7fb1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	af90b7982f9e83491575881365351306991619644e94fde6382d892f27a7fb1b
SHA3-384 hash:	65711d5826fc0a9be03a7aedee266defe7854104cd354e40a05ff468d5f626036a9be693953eaa62f3c305f22c1013cb
SHA1 hash:	705d715768046736632c6d21ab31a5d0cb437f08
MD5 hash:	ad34726ca0dcac3df4a00c082eddee4b
humanhash:	johnny-sad-diet-stairway
File name:	file
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	470'016 bytes
First seen:	2022-11-16 16:03:17 UTC
Last seen:	2022-11-16 17:58:12 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	12288:Bkw5n5i6c17T5kW2+zQ20N60RddsH5SF5SsK8QsrVRvb7/4yy+2n5q:Gw5505khTthJtSXo7vvAr+2g
Threatray	598 similar samples on MalwareBazaar
TLSH	T18AA41385410487D2CADC1778F3E2874456786B3AAEC356E62E85C1790DE32BB12CEFB5
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	5141494747556d1b (107 x RedLineStealer)
Reporter	jstrosch
Tags:	.NET exe MSIL RedLineStealer X64

Intelligence

File Origin

# of uploads :

# of downloads :

199

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

No threats detected

Analysis date:

2022-11-16 16:05:01 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f8afdc6d-485d-4d24-97c6-7c0295d9fb96

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/334921/

Detection(s):

SecuriteInfo.com.Win64.SpywareX-gen.32225.8589.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file

Sending a custom TCP request

DNS request

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/637509f44dc24c6f80b83932/reports/4c350e4d-4676-43fb-871e-29fbce967a86/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c1db7c99-0bb3-47eb-a61f-b02f8356e486

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1115046

Signature

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Snort IDS alert for network traffic

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af90b7982f9e83491575881365351306991619644e94fde6382d892f27a7fb1b/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v6ilpgbpt2busflvrajwknita2mrmglej2kp3zryfwes6j5h7mnq._file

Verdict:

unknown

RedLineStealer

3c181fbe5ba30cd988fe7ec49ceecb2962627f309613f63d674405127ba67f11

RedLineStealer

43e7901e0f50ea1ad4a609f04769dd0a3384443f685090e370e1d728595fc85f

RedLineStealer

c4a2d1a93c9da2d51ae8d0ef88b1dbf6fecd931714d9a09221c4f928f6861ce3

RedLineStealer

c6070d16218077441b9faa6ed769b764e27d7a506c2eea9ee98527d88f2c8eae

RedLineStealer

d29075d85d60a21f86b7ac67c4dcf41ca46a96b208681b3f3486d07182ec620a

RedLineStealer

f0c54f3f1717c1039dacdf7c4b63200d6f027e5a622c6eb65636d2089aa4b1c0

RedLineStealer

+ 588 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:3m infostealer spyware

Link:

https://tria.ge/reports/221116-thysdsfh71/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

RedLine payload

Malware Config

C2 Extraction:

jalocliche.xyz:81
chardhesha.xyz:81

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/671413b8-6353-4ab7-a33a-5316117696bc

Unpacked files

SH256 hash:

af90b7982f9e83491575881365351306991619644e94fde6382d892f27a7fb1b

MD5 hash:

ad34726ca0dcac3df4a00c082eddee4b

SHA1 hash:

705d715768046736632c6d21ab31a5d0cb437f08

Link:

https://www.unpac.me/results/668ab542-c131-46a6-bb98-fb1ff650a4c8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/af90b7982f9e83491575881365351306991619644e94fde6382d892f27a7fb1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.