MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6e70abfefff7c493d8eeea21998bae5581ac00ae08581b34ad9222f9ff7dce6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	b6e70abfefff7c493d8eeea21998bae5581ac00ae08581b34ad9222f9ff7dce6
SHA3-384 hash:	3c00a1f37cacf304b79c3d7c91598b75b25bd5937ec4c8f38fb3453c3baf2ecf60b7a3117c71b2fd7ccb1a4808c7bc76
SHA1 hash:	8019ffe84ba230b3c96c7cb821a251777a0b9b28
MD5 hash:	e3e082f1101cccda0fec2d95b352fc98
humanhash:	september-carolina-three-social
File name:	e3e082f1101cccda0fec2d95b352fc98.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	423'424 bytes
First seen:	2021-10-11 14:02:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	61b48ca689a3ea2404ab8a6768ce938b (6 x RedLineStealer, 3 x Smoke Loader, 1 x DanaBot)
ssdeep	6144:OADmz4g9XsBBGW1hrFYBcJVhus/4a7LKx0DjVQymKbhUw:0z4guBBGAhBYBinusQa7LBDjVQyNVR
Threatray	4'004 similar samples on MalwareBazaar
TLSH	T1C4949D10B7A0C135F4F216F84ABAB269A92E79A16724D4CB13D42ADE96347D1FC303D7
File icon (PE):
dhash icon	9824e790c4e72158 (31 x RedLineStealer, 18 x Smoke Loader, 16 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

205

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e3e082f1101cccda0fec2d95b352fc98.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-11 16:18:56 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/89a0da9d-3d57-463c-9672-f96195cbd067

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/196657/

Detection(s):

SecuriteInfo.com.Trojan.MalPack.GS.29891.25606.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/616444191c2d58ba7401d9f9/reports/6496db60-1b21-4ccf-a152-7c846ab832b5/overview

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0ab2cbe0-9626-4623-b375-c6a6cb7c0bed

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/867864

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redlinestealer

Link:

https://mwdb.cert.pl/sample/b6e70abfefff7c493d8eeea21998bae5581ac00ae08581b34ad9222f9ff7dce6/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-10-11 14:06:47 UTC

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=w3tqvp7p756espmo52rbtgf24vmbvqak4ccydm2k3erc7h7x3tta._file

Verdict:

malicious

RedLineStealer

24198e6120171960649f2ea10d3a4d13291040c62f140fb33d5f527970788700

RedLineStealer

31e3f9184e29f3979f4d44b4ee84e806fd45e899a61e40b3d1b11dcd6d79a7ad

RedLineStealer

3236d82523149bd761bd3908a7fcefcc3a1f96e08c4914f7da8dc0ee0cdfcf8e

RedLineStealer

4922891e6b053807054a0c672b1c32ac287e9784200da2d6d75ef5c124da366e

RedLineStealer

55a7aa311173e2a86f607102fa9943b6d0b209c47c875fea3bccb69d54bf966b

RedLineStealer

95131b7d3857e99c14a70e5a6f44c646e55276fe455d5176ea1bd176eb1b992c

RedLineStealer

a03a82def98db18ed5401f6c597dd0693c9f90b1a9a3fee5f99efc6d5327ac73

RedLineStealer

b83f53f67a2b2fa4d2abf6a0ce7b75542685661deaac9aeb2159f5e25977e10e

RedLineStealer

c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb

RedLineStealer

+ 3'994 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:udp infostealer

Link:

https://tria.ge/reports/211011-rcp7yshdd6/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.9.20.20:13441

Unpacked files

SH256 hash:

90b0e7d902727351e4a88f3b02c2d3d15d202b2a0ea118c961c21c258617c1cf

MD5 hash:

6ac070b383c57c84bce059f1611a8bc0

SHA1 hash:

f8768f72c0cc63945cbe31b75e39a9d207db06b5

Link:

https://www.unpac.me/results/27b54106-62d1-4c5a-b672-e31ca5517364/

SH256 hash:

74ec8e7f6661e87226bb95a4ba97ae828c45f3142b78d068492cff7162bbbd47

MD5 hash:

f007c18cee4cbdd6992122a8a216ccc0

SHA1 hash:

5b931b76947bb4484ae7b94a60e83c65f92b21b3

Link:

https://www.unpac.me/results/27b54106-62d1-4c5a-b672-e31ca5517364/

SH256 hash:

fc667313899f6647f9d67a16af1234ac6b109223b7c3ce0d178614985cfd27e9

MD5 hash:

24eb234842defb045592109e300bed32

SHA1 hash:

4fa3017ddf932a7f7ae7fbbeda7eacbea609f283

Link:

https://www.unpac.me/results/27b54106-62d1-4c5a-b672-e31ca5517364/

SH256 hash:

b6e70abfefff7c493d8eeea21998bae5581ac00ae08581b34ad9222f9ff7dce6

MD5 hash:

e3e082f1101cccda0fec2d95b352fc98

SHA1 hash:

8019ffe84ba230b3c96c7cb821a251777a0b9b28

Link:

https://www.unpac.me/results/27b54106-62d1-4c5a-b672-e31ca5517364/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/b6e70abfefff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b6e70abfefff7c493d8eeea21998bae5581ac00ae08581b34ad9222f9ff7dce6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.