MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
SHA3-384 hash: a3e07234cfb4c37c8f366e871ac26c1e01a6f4a10926c5d6a6ed03ef46fec803e6f9c10277f897ec69a6bd1353aa63c1
SHA1 hash: 2102e9f86537703b46baf652fdc08d1fa7cad29d
MD5 hash: 18987447bab6093e3ad281f7f672b201
humanhash: paris-queen-zebra-asparagus
File name:18987447bab6093e3ad281f7f672b201.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:481'792 bytes
First seen:2022-11-02 07:05:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c06d8a269c77947b51e5a2f5172b35fe (3 x RedLineStealer, 1 x Stop)
ssdeep 6144:znOlk5aUlI5Cwg/zdNJmadN84tioXiX9jwx8ATVwIE5so5mh57ITsq:znOFUlJ7/zdNJmaNpYVMRTe99O7
TLSH T1DDA4F1E234D1C032C19A3534892ACB947A7BBD31D5A8560737B8376E6F313D29AB9313
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9999b13464e6c64a (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.24:47242

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
18987447bab6093e3ad281f7f672b201.exe
Verdict:
Malicious activity
Analysis date:
2022-11-02 07:09:40 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/7d7791d9-5209-4843-b459-87fb3daaeef1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/327005/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.63325953.2185.30340.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Connecting to a non-recommended domain
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/636216de9b9bf84bf679d56c/reports/d2ef0052-9449-4809-a8d1-f3083835afe9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f2bc7d8-9ff8-485a-8337-fa27474e514f
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1103009
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-02 04:30:19 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xia3o5d7g6iq3xtc4bu2bsshv3eat4bhhgw6jggrubuuelxku4za._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:dozkey discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221102-hw3sqaageq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
193.106.191.24:47242
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ab69622a-b432-4aaa-bddc-dbd6ee34b460
Unpacked files
SH256 hash:
92421f57176162a77d2025448c3c9df2fc83967ca67dfa4136e8dc8484468aba
MD5 hash:
b1c62409fab5ccc6efb6022c189121e9
SHA1 hash:
e975916770fd62a40b229b7e2ea86d71e00b438e
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/1f015351-d3e9-45c0-a8c6-398711a21f51/
Parent samples :
ab53c1842d525b940656ef13277dcc83f1dc1d42cdc2f1172f786e9ae76421c5
ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
af669fa4f200fcc0c00d9aea49027d3d2ace15d6b055156195cf05ee6cd7906d
SH256 hash:
294794b4e480bfaf0f96bff492d33c115a47d07c7b727618ca61f092d0f93096
MD5 hash:
2cb65c4dd615432dfcad784a2d3184c9
SHA1 hash:
5f7069d73db72c4786b5f88b7ebeb1b6adafd5a2
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/1f015351-d3e9-45c0-a8c6-398711a21f51/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
ab53c1842d525b940656ef13277dcc83f1dc1d42cdc2f1172f786e9ae76421c5
ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
af669fa4f200fcc0c00d9aea49027d3d2ace15d6b055156195cf05ee6cd7906d
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
fd5e4d6282eb852549b996ab98aef3bc22c7f6e053a4fdc742b767daa801024b
MD5 hash:
8c982caea354e82103b3a9d4f4e60ae9
SHA1 hash:
4635f41b7a6fa18c4d09dc8416aa1a00c6dbdb10
Link:
https://www.unpac.me/results/1f015351-d3e9-45c0-a8c6-398711a21f51/
SH256 hash:
ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
MD5 hash:
18987447bab6093e3ad281f7f672b201
SHA1 hash:
2102e9f86537703b46baf652fdc08d1fa7cad29d
Link:
https://www.unpac.me/results/1f015351-d3e9-45c0-a8c6-398711a21f51/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ba01b7747f37/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2384053/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/327005/

Comments