MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3f12573454719aea5948a71ec1b85433b0ec55c7d65a23ab3befe9b81e4f2d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3f12573454719aea5948a71ec1b85433b0ec55c7d65a23ab3befe9b81e4f2d2
SHA3-384 hash: a652516ef0bcbe95096fd30eb46c8590fb5bb91f01d23bf6ca54766f8d906c0e8ac0ecf8a6fa2273a9fad94051298e20
SHA1 hash: 3bfe32ae61d1aad8671ae5f1a97bbb22b7957ecb
MD5 hash: b047a5f638399b6496ab4e53b5981730
humanhash: october-xray-connecticut-crazy
File name:b047a5f638399b6496ab4e53b5981730.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:611'840 bytes
First seen:2022-03-30 10:27:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 445554923421947cbff896012e27345a (301 x RedLineStealer, 11 x RaccoonStealer, 5 x CoinMiner)
ssdeep 12288:XP8IAq9BrNdwMHOIRvpLQS03ULaHNqrxlKIQNo2McB8XX3o5UV5K6:/dAq9z5vv5kEaHNYK3YeUX3oUV5K6
TLSH T1F0D423B3E7C06D1DC24E09FE8F15124EB8D8167EABF4F196A7774902996045AEF08C78
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
95.181.164.24:23078

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.181.164.24:23078 https://threatfox.abuse.ch/ioc/466725/

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/259614/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Creating a process with a hidden window
Stealing user critical data
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/624430b81f2042394852a64e/reports/c6e4739b-6684-4570-b90a-003ffae4d959/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4d3affe2-de04-42e2-9b0a-53809c0e6ece
Result
Threat name:
Phoenix Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/967488
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3f12573454719aea5948a71ec1b85433b0ec55c7d65a23ab3befe9b81e4f2d2/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2022-03-25 21:40:58 UTC
File Type:
PE (Exe)
AV detection:
31 of 42 (73.81%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpysk42fi4m25jmurjy6yg4fim5q5rk4pvs2eovtx37jxape6lja._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer persistence spyware
Link:
https://tria.ge/reports/220330-mhnh4afhem/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
95.181.164.24:23078
Unpacked files
SH256 hash:
21ebe1badccf0165626d381fca597f0e1aa358b37b1a58d7deaa6a5c55fee238
MD5 hash:
31b6434c47d629321e68be2bcd98beae
SHA1 hash:
69d409af30abb780ba794daf175f0de639fa69ea
Link:
https://www.unpac.me/results/847b25f4-4e92-4948-b599-5463b8278a3c/
SH256 hash:
84ef6e38c9fd70ee1240533eb215838418f59325d7f9ef61a0bb35867c064d25
MD5 hash:
a46f5ea2387950c953eeec8927fe4ee3
SHA1 hash:
bc961e9e0cd85894bd9decae190cf6c96568d4c7
Link:
https://www.unpac.me/results/847b25f4-4e92-4948-b599-5463b8278a3c/
SH256 hash:
b3f12573454719aea5948a71ec1b85433b0ec55c7d65a23ab3befe9b81e4f2d2
MD5 hash:
b047a5f638399b6496ab4e53b5981730
SHA1 hash:
3bfe32ae61d1aad8671ae5f1a97bbb22b7957ecb
Link:
https://www.unpac.me/results/847b25f4-4e92-4948-b599-5463b8278a3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3f12573454719aea5948a71ec1b85433b0ec55c7d65a23ab3befe9b81e4f2d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/259614/

Comments