MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6088d2366bd800caa559867848abb1f192ea1e88350409aa91989858285bd84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6088d2366bd800caa559867848abb1f192ea1e88350409aa91989858285bd84
SHA3-384 hash: cdecf3a5d7ae797742f9ccf1b8b592952172a052c4358edf9398972f8574b8b3b59d1788a739cd12cd4b04b96ecf8154
SHA1 hash: 3b24decfcf8083d49c1d6f4efc30aae7a25aae13
MD5 hash: 646f4905675a72ed633380e124b0c169
humanhash: five-oxygen-lemon-mango
File name:b6088d2366bd800caa559867848abb1f192ea1e883504.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:426'496 bytes
First seen:2021-05-23 00:20:24 UTC
Last seen:2021-05-23 01:01:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 14fdb4b837b8c194816b4cabd515f1bf (1 x RedLineStealer)
ssdeep 12288:wNeFzReCLKgvP0Wv7HW5NkmtFHkydyOxnfXsL:wWReoJ7Hg5bEygOxfXsL
Threatray 2'123 similar samples on MalwareBazaar
TLSH EF94AF20A6A1C035F1FF16F449B982B8753ABDA1573450FB22C53AEE5634AE49E3074F
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.139.187.153:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.139.187.153:80 https://threatfox.abuse.ch/ioc/57246/

Intelligence

File Origin
# of uploads :
2
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5C724AD44730B5418F8380A943BEF38C.exe
Verdict:
Malicious activity
Analysis date:
2021-05-22 21:46:20 UTC
Tags:
evasion loader trojan rat redline
Link:
https://app.any.run/tasks/7f9f7eab-7396-43e0-a1fb-637e80f638ed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Malware.Pwsx-9863541-0
Create hunting rule

Win.Malware.Pwsx-9863626-0
Create hunting rule

Win.Trojan.Malwarex-9863806-0
Create hunting rule

Win.Dropper.Gandcrypt-9863807-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Connection attempt
Sending an HTTP POST request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/789096
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Performs DNS queries to domains with low reputation
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-05-23 00:36:28 UTC
AV detection:
32 of 47 (68.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wyei2i3gxwaazksvtbtyjcv3d4ms5ipiqniebgvjdgeylaufxwca._file
Verdict:
malicious
Similar samples:
07b18b26f93bfd5240f4afbc62dc9762ad594926aeff9ecec0de7fb4a7b70822
RedLineStealer
1bf9a15445a908fdcd7d4a5a0584678a1efb086d1eccbf0ae60393f6be208919
RedLineStealer
1fb9a15f04e22fa2ffed97cc9ea058210140517821eae6a84ab2dead604a8179
RedLineStealer
4f8fe2f14c19ae475f397f4ea62e59ef42adc7c5af1ced0fca00d8963c9fb6d6
RedLineStealer
524c53b84d8d7d5434d82e266cdf1fce9665558ca8a9ced8e7404b12e0604a24
RedLineStealer
55494964fba2cbdc0d2e0fd94518961663072a3913477d4035e3cfd274d2d39d
RedLineStealer
82b71a1fc1c575129b572ee2ec5f20e7008e373400b8f0ada298e073fe3d5112
RedLineStealer
c06a0e78bbdb7eb777ee46932da052fc2bc4efc2987e63bad29d2177cdcb7cb4
RedLineStealer
c5abf55b0591c96c64316cef1b7c5124f3b7ab3d05bc75ab80ae17c53d01dc72
RedLineStealer
eabf5a5a3b36ea517c3b37b7cdc50356e84cb94c971949e2bcb6635fb43bed7b
RedLineStealer
+ 2'113 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:nastya666 infostealer
Link:
https://tria.ge/reports/210523-e37zw5pw4j/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine Payload
Malware Config
C2 Extraction:
qusenero.xyz:80
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6088d2366bd800caa559867848abb1f192ea1e88350409aa91989858285bd84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-23 00:59:48 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0045] File System Micro-objective::Copy File
4) [C0047] File System Micro-objective::Delete File
5) [C0049] File System Micro-objective::Get File Attributes
6) [C0051] File System Micro-objective::Read File
7) [C0052] File System Micro-objective::Writes File
8) [C0033] Operating System Micro-objective::Console
9) [C0040] Process Micro-objective::Allocate Thread Local Storage
10) [C0043] Process Micro-objective::Check Mutex
11) [C0041] Process Micro-objective::Set Thread Local Storage Value
12) [C0018] Process Micro-objective::Terminate Process
13) [C0039] Process Micro-objective::Terminate Thread