🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b913e40e8a85b8f111abd51b10e8b60a3e1b9a9e5f54c99d52fc3262147dad15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b913e40e8a85b8f111abd51b10e8b60a3e1b9a9e5f54c99d52fc3262147dad15
SHA3-384 hash: 3c58d24bc9695c6cdd58c6194d16d97085d601439d18c813860f2c7b0eab2c269f2209a73c78ef2198575d022809bd6b
SHA1 hash: 2bfc45ba51d499588760d7e4393e3f1d0a779d32
MD5 hash: a0afd52a209a4c21a8fa77af58734fe6
humanhash: apart-december-low-dakota
File name:RedLine_stag3.dll
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:129'760 bytes
First seen:2021-09-26 20:54:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 3072:5iKrmz3BY8es6F0WtZkeMMMMMMMMMMMMMMMMMMMMM7eMMMMMMMMMMMMMMMMMMMMq:sK18StIexyaCv
Threatray 2'007 similar samples on MalwareBazaar
TLSH T16FC32B2597DD8F3AF7FE0634A072120482F4E186A181DB4E4DC174FB1A56BC16A277FA
Reporter aaqeel87
Tags:dll Redline RedLineStealer unpacked


Avatar
aaqeel87
RedLine unpacked Stage 3

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/191849/
Detection(s):
Win.Packed.Bulz-9883367-0
Create hunting rule

Win.Packed.Bulz-9888336-0
Create hunting rule

Win.Packed.Bulz-9891195-0
Create hunting rule

Win.Packed.Generickdz-9885340-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/671ceae8-1e3a-40d6-86e9-fbe0362f9847
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/858543
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 490974 Sample: RedLine_stag3.dll Startdate: 26/09/2021 Architecture: WINDOWS Score: 64 13 Multi AV Scanner detection for submitted file 2->13 15 Yara detected RedLine Stealer 2->15 17 .NET source code contains potential unpacker 2->17 19 Machine Learning detection for sample 2->19 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b913e40e8a85b8f111abd51b10e8b60a3e1b9a9e5f54c99d52fc3262147dad15/
Threat name:
ByteCode-MSIL.Trojan.RelineStealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-26 20:55:06 UTC
AV detection:
21 of 45 (46.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xej6idukqw4pcenl2unrb2fwbi7bxgu6l5kmthks7qzgefd5vukq._file
Verdict:
malicious
Similar samples:
34c3d185dc61472fccfc4b49d646ccca9d057596dc8947e62773ca63205ef67b
RedLineStealer
40ec0b45e766ca970a159f6abbc490a65ae7bd1c5a6171993477824cb18bb5ce
RedLineStealer
7416ee3fa4326a552ffc4d9775d4dc9024d364d0d04b1d2ffd1e65f4ff3ba932
RedLineStealer
75e6205e4386442ebdaa1c76d05379909c9f9c6bdb93b518eef96862ddb9756c
RedLineStealer
89a33850501752a857fcd4dcf572ab38be1d61c07273d2c2cb546a84b02a318e
RedLineStealer
a2b4c803b5bafe2e4428cf462bb78c177fcc0c04ca746a82608231bedc47c21f
RedLineStealer
a560f6d0c5e0959293e2478f3214f57b7494058a3bc71ed17d68a59472a66170
RedLineStealer
bf108bbbc4fbd8c22e7518becd26404860732f3e47d8290497220017fb79ece9
RedLineStealer
c9a73eade294a277e1120bc6107a13b640ba797f09d3edfa3992577a46275ea0
RedLineStealer
d9161a1a9dda00926bc9c6207f1629342db35543405ac562d3f749d5d717aa63
RedLineStealer
+ 1'997 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline
Link:
https://tria.ge/reports/210926-zqfjnsfch8/
Unpacked files
SH256 hash:
b913e40e8a85b8f111abd51b10e8b60a3e1b9a9e5f54c99d52fc3262147dad15
MD5 hash:
a0afd52a209a4c21a8fa77af58734fe6
SHA1 hash:
2bfc45ba51d499588760d7e4393e3f1d0a779d32
Link:
https://www.unpac.me/results/0cdfe255-e580-4983-a132-e471dbfaeb69/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.44
Link:
https://yomi.yoroi.company/submissions/b913e40e8a85b8f111abd51b10e8b60a3e1b9a9e5f54c99d52fc3262147dad15

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:RedLine_Campaign_June2021
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer's June 2021 campaign.
Reference:https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/191849/

Comments