MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2
SHA3-384 hash: e1b1e0e1d59a1d9ce49989f1162d9e5ea53756297741d3a955e19d692bae0e31d6e7471275ec5a8cdf22b42046a2b824
SHA1 hash: 9cccacd98f635eda2404b67c5c2f07ecf4a66e55
MD5 hash: 034b74114748376cbee50f04bbc9bed0
humanhash: florida-alaska-low-oregon
File name:034b74114748376cbee50f04bbc9bed0.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:325'725 bytes
First seen:2022-11-15 11:21:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 81cb68cc20ee69ac5f93f68a2f825c6d (15 x RedLineStealer, 7 x Amadey, 6 x Smoke Loader)
ssdeep 6144:eUgLpjp90jrpL6sz42bqrJiZXU+lpEoZ2v3pCLT0mY0:eUg91qjrlJzCUZXU+7E3v5CLTJP
Threatray 11'514 similar samples on MalwareBazaar
TLSH T16564022279A0C073C60768304869C2E17B69FDF169759687BB8C3F1E6F312D26B66707
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2dac1370399b9b91 (45 x RedLineStealer, 35 x Smoke Loader, 19 x Amadey)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
034b74114748376cbee50f04bbc9bed0.exe
Verdict:
Malicious activity
Analysis date:
2022-11-15 11:26:52 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/49d961aa-d890-4cff-8ed1-796e5ff323b1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/334189/
Detection(s):
SecuriteInfo.com.Malware.PDB-35.UNOFFICIAL
Create hunting rule

Win.Packed.Botx-9977720-0
Create hunting rule

Win.Packed.Botx-9977721-0
Create hunting rule

Win.Packed.Botx-9977732-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader45.31457.28528.4358.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6373765ff75d59fef0b973cd/reports/77d0879c-68c7-4444-b300-f6928d706044/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ad0d253-5f59-49ae-85ea-f99a1824bbfb
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1114364
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-11-15 11:22:10 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
32 of 40 (80.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xb2wumwdem5akell62ga7b42cf22gamnaf3ci56ulqfap47bqkza._file
Verdict:
malicious
Similar samples:
04a31421bf2de2881d9958bf918c92d1ee988f670ce6200dca8064a6581d33f9
RedLineStealer
086a34bfeac2c52d33f2d3f04cbba8a549de789c81d6f3fd1ea9c5505e665dea
RedLineStealer
3895be69980fb6b7664e012d102c2e81cbc38de70708d98b3b832236ada6c041
RedLineStealer
3eac5bbdfde1725766ce68a53713f9977789dfc8f3890f5fd9ef9c622ea13a05
RedLineStealer
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
RedLineStealer
+ 11'504 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:123 infostealer
Link:
https://tria.ge/reports/221115-ngkw9adf27/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine payload
Malware Config
C2 Extraction:
78.153.144.3:2510
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3de3bb46-cc01-4dbb-a6b0-a1d979802552
Unpacked files
SH256 hash:
6efe7fd02d5f6478042dbbe35d7613e2136b9a41acf3e93c0340f2b2ec0186b6
MD5 hash:
6294c16b02fc00aba7f74b89d14a6b5e
SHA1 hash:
f8103857ba2223810975403330f813c3ffbd3f74
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/e26d954e-3aea-42cd-ac8e-149a533b50ec/
Parent samples :
66f9f56d10a43613ab86daf4baabea0481d3394b02f099872f2104a075a12026
5520de785a54df91deda63975bfea2bce483e8020928aaf8eed5c8ce664f0db2
bbe934a832db11f1f3162fa27be965a88f92b8a25cfe965b6076669d3da8202e
cb30fb7ffcd9881326c240d4b3251d174a578b3ddf56653d276a540890799f97
04a31421bf2de2881d9958bf918c92d1ee988f670ce6200dca8064a6581d33f9
3895be69980fb6b7664e012d102c2e81cbc38de70708d98b3b832236ada6c041
086a34bfeac2c52d33f2d3f04cbba8a549de789c81d6f3fd1ea9c5505e665dea
93866cf439f7d6fae1060563f68d7ef6e2069fb900ccf13378d08da3bb053dde
b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2
f8c1e98bd43ca372b1411738dc5b392a2a41f88093793a17289663ee0fc0406f
a858a5d669f0f5523be8d7e6bca2410b280d4637bcc60a2c468b46b6b70ae8cd
3240455c14048d3813e37e909420e90f7d2afe0a6d73efdf6e6aa7b96b63ebd1
fa6defc9dadc86b3ce81f02e437a24af6b995fb6616a0ecb073b090bdbfd801d
6964a2dc13ce980cd9126100a4fa1bb882b89815eba044a091217e1f9bc9e649
SH256 hash:
99dbe84cb02044cfd3396f950e983f6094f6794d4f7ddd4511f880cac391519d
MD5 hash:
d054e5e4986f2e23672afb84a412d4d5
SHA1 hash:
d41e9f6df48ba29c73aeaaf3a4238d98d756bd25
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/e26d954e-3aea-42cd-ac8e-149a533b50ec/
Parent samples :
5520de785a54df91deda63975bfea2bce483e8020928aaf8eed5c8ce664f0db2
cb30fb7ffcd9881326c240d4b3251d174a578b3ddf56653d276a540890799f97
b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2
f8c1e98bd43ca372b1411738dc5b392a2a41f88093793a17289663ee0fc0406f
3240455c14048d3813e37e909420e90f7d2afe0a6d73efdf6e6aa7b96b63ebd1
fa6defc9dadc86b3ce81f02e437a24af6b995fb6616a0ecb073b090bdbfd801d
6964a2dc13ce980cd9126100a4fa1bb882b89815eba044a091217e1f9bc9e649
SH256 hash:
8e4a9fc9820dfc3fdfc793aec3676d06b5b4ebfe512a62eb4a9032d0735f775c
MD5 hash:
42cfadd8c7cac115b2813dcdc145f5ec
SHA1 hash:
1d6d4f6cc24dcf3dde14a8ea4c9a6930447d044d
Link:
https://www.unpac.me/results/e26d954e-3aea-42cd-ac8e-149a533b50ec/
SH256 hash:
b8756a32c3233a05116bf68c0f879a1175a3018d01762477d45c0a07f3e182b2
MD5 hash:
034b74114748376cbee50f04bbc9bed0
SHA1 hash:
9cccacd98f635eda2404b67c5c2f07ecf4a66e55
Link:
https://www.unpac.me/results/e26d954e-3aea-42cd-ac8e-149a533b50ec/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/334189/

Comments