🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7e4589b25eb2abba991792791c66f2c6714d5c0a4e2aaf382c668e1292d92ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 5


Intelligence 5 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7e4589b25eb2abba991792791c66f2c6714d5c0a4e2aaf382c668e1292d92ec
SHA3-384 hash: efbe57f044885233158ad7edf0ae251ca4fb3f355c76539183af59d48840f69fd860d41939aea1609436088195f7b0ad
SHA1 hash: 0d459179ac1cd203cd5df51c4ed067b9b6eae28d
MD5 hash: b0d49c755775c6d176bce924a5c62ad8
humanhash: south-king-lima-quiet
File name:Cсleaner.v6.06.10144.zip
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:910'467 bytes
First seen:2023-01-23 18:10:22 UTC
Last seen:2023-01-23 21:18:47 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:FAOaZ+zS34fvdFlGaXDrIuSy7z4GBaL/5rYr1bONoFzgXS4Jjrk0MgnZFsZnKFGh:FO+O3WdiIDsu4J/96FOUK5YuZoyGKiD
TLSH T1F41512FC30A57825F4B5237B63093CAEFB5CB258C96775479E6280DAB9471462F07E02
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter adm1n_usa32
Tags:exe file-pumped RAT Redline RedLineStealer zip


Avatar
adm1n_usa32
zip due to large filesize (650+ mb)

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
65.109.139.121:28859 https://threatfox.abuse.ch/ioc/1073646/

Intelligence

File Origin
# of uploads :
4
# of downloads :
292
Origin country :
US US
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Cсleaner.v6.06.10144.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:685'101'568 bytes
SHA256 hash: 3009c5a970785f3bff600eb2ccf8051a8e51fd2dc6bc941306ef8b065446a1a8
MD5 hash: ab6a66c96c4984517cc4760e5f948fe4
De-pumped file size:620'032 bytes (Vs. original size of 685'101'568 bytes)
De-pumped SHA256 hash: 0eb0369770195b57593f8d1f739637f3dd4803491cf243cf6c9f426351a6c88d
De-pumped MD5 hash: 97372bbaea398189684749ff0a760db2
MIME type:application/x-dosexec
Signature RedLineStealer
Vendor Threat Intelligence
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7e4589b25eb2abba991792791c66f2c6714d5c0a4e2aaf382c668e1292d92ec/
Threat name:
Archive.Trojan.Mardom
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 19:23:23 UTC
AV detection:
6 of 37 (16.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w7sfrgzf5mvlxkmrpetzdrtpfrtrjvoautrkv44cyzuockjnslwa._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware
Link:
https://tria.ge/reports/230123-xm2xdsgd6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Loads dropped DLL
Uses the VBS compiler for execution
Executes dropped EXE
RedLine
Malware Config
C2 Extraction:
65.109.139.121:28859
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b7e4589b25eb2abba991792791c66f2c6714d5c0a4e2aaf382c668e1292d92ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Win32_Trojan_RedLineStealer
Create hunting rule
Author:Netskope Threat Labs
Description:Identifies RedLine Stealer samples
Reference:deb95cae4ba26dfba536402318154405

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

zip b7e4589b25eb2abba991792791c66f2c6714d5c0a4e2aaf382c668e1292d92ec

(this sample)

anyrun
any.run
https://app.any.run/tasks/96211eca-b3a1-4c9e-a1c7-2c3e7a2fbe9d
  
Delivery method
Distributed via web download

Comments