MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
SHA3-384 hash: 633a477c6a71ba4338d7a169126de5d865043cb94c8730fcf12f1f48c0d98e96d644aca5a6ce75deb641c0a4be15dcda
SHA1 hash: 8b7205ad49f10acf6f66b8ad68a9d10189f1dc3b
MD5 hash: 8d411fc8855b010bf2d4baf32eb10172
humanhash: october-eleven-diet-pip
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:426'496 bytes
First seen:2023-02-02 10:30:43 UTC
Last seen:2023-02-02 10:58:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 51ceb91dba0ace98219e4727f07b1743 (12 x RedLineStealer, 8 x Amadey, 5 x Smoke Loader)
ssdeep 6144:adL6wfH99TKO/n07oFe7kApKdb26XOaHO0/ToWvLXoplGW9/CJTk637eQfnd5MDB:2HHnKin077kT75/zoplGW9CJb7d5M
TLSH T1F594BF0372E1BC49E532CB718F1EE6F47E1FB9508E1923761218AB9F17721E2C962725
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon aca4a0809494a4c0 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.110.203.101/puta/brazilx86.exe

Intelligence

File Origin
# of uploads :
10
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-02-02 10:33:19 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/357a52bd-0a45-4745-97b0-8592ddf5ff3d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/359451/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63db90e789bd67c10fdc3010/reports/7105bb9e-59ba-4ffd-9a18-dde503d7b3ee/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb2a86ed-1972-4f8e-ba2b-a2af8c3347b2
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1164120
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2023-02-02 10:31:07 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wt6kqyzana5vc5rgruovvpvmwwhaauspzaytc2gvjyjamcwetzya._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:2-2-2023@ discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230202-mkc55sfg69/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
91.215.85.155:32796
Unpacked files
SH256 hash:
02d15cc70446bda384a483ed4d81e5fd4bf7a2c5848ea5ec355fa693dfff8503
MD5 hash:
b95cc5ff84e75ce7bbc38edf9f0746fa
SHA1 hash:
a3c4b7ea0200305a45cd6214ec63ec6948dfb6b8
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/4b068b79-c09d-4410-b25f-e7674f298d20/
Parent samples :
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
3e3ba87662306453fe06acc01775d04e54c3ec4a14eeac2b865b06ddf26e5fb0
MD5 hash:
b90eb1c5816c56a2564ee8b51ed38ebc
SHA1 hash:
259c4a7239df33595f4e206d57a8fc329f3be124
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/4b068b79-c09d-4410-b25f-e7674f298d20/
Parent samples :
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
SH256 hash:
a09bb30e4ac852eeb4fbfe3c4900606f83775936b6be3c175c4dc773376a273b
MD5 hash:
135d8693f5bddda089165c5d0461cf8e
SHA1 hash:
0b93c573787c2bbd9f6dc0a5aecacd95d271d3de
Link:
https://www.unpac.me/results/4b068b79-c09d-4410-b25f-e7674f298d20/
SH256 hash:
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
MD5 hash:
8d411fc8855b010bf2d4baf32eb10172
SHA1 hash:
8b7205ad49f10acf6f66b8ad68a9d10189f1dc3b
Link:
https://www.unpac.me/results/4b068b79-c09d-4410-b25f-e7674f298d20/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4fca8632068/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/359451/
  
URLhaus
https://urlhaus.abuse.ch/url/2526742/
  
URLhaus
https://urlhaus.abuse.ch/url/2498781/

Comments