MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba195a9f090cb803df55df40d839f95e335234a13d3207f65efa46c3d0f837d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 1 File information Comments 1

SHA256 hash:	ba195a9f090cb803df55df40d839f95e335234a13d3207f65efa46c3d0f837d0
SHA3-384 hash:	83806c906f84df60b17dab8afe4683554415ff0f9f94de59c2f1a9fa00f45b6814bed2d058e818117b5b84e92e3945b5
SHA1 hash:	32b1f1e9ee2aee5a239ba8b37f4c7a98046fd44e
MD5 hash:	0be08b56ec9c9b926b336ec062c55eaa
humanhash:	table-georgia-artist-video
File name:	0be08b56ec9c9b926b336ec062c55eaa
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	387'072 bytes
First seen:	2022-02-05 17:54:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1a3cf179d845c62d49a765b8e54e41fa (4 x RedLineStealer, 1 x Stop)
ssdeep	6144:JbyySzXaaks8VCYfWPon3AK9PNsyHUHzZ3Pi2s2/QCk2g2aTxv6FKr1bP:JUXa6MCYfxn3AcuB3ns8QCbla
Threatray	4'605 similar samples on MalwareBazaar
TLSH	T1BB84CF10BB90C035F1B702F449B693ACAA3E7AB15B3594CF23D51AEA16346E5EC3135B
File icon (PE):
dhash icon	b6dacaaecee6baa6 (15 x RedLineStealer, 14 x Stop, 7 x RaccoonStealer)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
45.11.26.87:81	https://threatfox.abuse.ch/ioc/379466/

Intelligence

File Origin

# of uploads :

# of downloads :

209

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0be08b56ec9c9b926b336ec062c55eaa

Verdict:

Malicious activity

Analysis date:

2022-02-05 18:08:50 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/a452c982-e4e7-4fab-b4aa-caf75e212a55

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/233616/

Detection(s):

Win.Packed.Filerepmalware-9938531-0

Win.Packed.Generic-9938536-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Сreating synchronization primitives

Sending a custom TCP request

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Query of malicious DNS domain

Sending a TCP request to an infection source

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/6072/overview

Behaviour

MalwareBazaar

CPUID_Instruction

MeasuringTime

SystemUptime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61feb9c2a72f86da695e9184/reports/896e67c1-78fd-46ae-b210-b6ebeaebb757/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/927eee5f-bb4e-4984-9f5a-21747833d053

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/934561

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2022-02-05 17:55:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 43 (41.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ximvvhyjbs4ahx2v35anqopzlyzvenfbhuzap5s67jdmhuhyg7ia._file

Verdict:

malicious

RedLineStealer

1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45

RedLineStealer

20dc6e65625512bceeed56e1754a96608ad8eb6e5648ec995a2a6fe6c2f6689f

RedLineStealer

2eecd263f2ccf106ab5ad42ed0bb8c981f9067a1273cc3186cb731aac8fbb702

RedLineStealer

51dab2aed9a33526c883c60b970d756e7fe8215630861d61c839d4a491a91120

RedLineStealer

7227c5067dc82a381a3c7485a21c64b702f7e987a46d1349f95e269399e862eb

RedLineStealer

7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574

RedLineStealer

819c9d8c88fc1ffbfeae1797646f7b90f930fef4dae513fe8e43fad3bf475bf0

RedLineStealer

9e719c4dd5e1086d5197fded7b8cdb0d3d592c0636b0d469fcda22c9723e8e7c

RedLineStealer

+ 4'595 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:3 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220205-whf9fsdhc4/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Drops file in Windows directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Suspicious use of NtCreateProcessExOtherParentProcess

Malware Config

C2 Extraction:

stata2021.best:81

Unpacked files

SH256 hash:

9aad52a48dd081e3f56e95ab6803049b2364afedb10efa788c374050addb19de

MD5 hash:

7b53035d6feebceddd613b8c250786ed

SHA1 hash:

1a9b3af36f07f5ce294c7388af619334e9875992

Link:

https://www.unpac.me/results/22542532-24ec-43c1-a02a-79e1e3deafb8/

SH256 hash:

61edfd031866feacee8d45d600ad19336e22f76c117d08a9d9f038fa67c31d27

MD5 hash:

e65bbbc4537f602f9e86145e4f49c959

SHA1 hash:

64d2d32d67c8edee0130c8de0f59108340ef75fe

Link:

https://www.unpac.me/results/22542532-24ec-43c1-a02a-79e1e3deafb8/

SH256 hash:

fd684e2651ae87a4fd35c6d580452ebbb76275edaf3480f7ba9a43b0089db1d3

MD5 hash:

3c83586d45a594693b69cc93ee3982d4

SHA1 hash:

7b7cfe6d6468cec7a0f0c3c337ed4c82d1cd0f81

Link:

https://www.unpac.me/results/22542532-24ec-43c1-a02a-79e1e3deafb8/

SH256 hash:

ba195a9f090cb803df55df40d839f95e335234a13d3207f65efa46c3d0f837d0

MD5 hash:

0be08b56ec9c9b926b336ec062c55eaa

SHA1 hash:

32b1f1e9ee2aee5a239ba8b37f4c7a98046fd44e

Link:

https://www.unpac.me/results/22542532-24ec-43c1-a02a-79e1e3deafb8/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/ba195a9f090c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ba195a9f090cb803df55df40d839f95e335234a13d3207f65efa46c3d0f837d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.