MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bab1f30a726af13b0834d93f505d9331ab10d5735cdc818c0140a3f07ac93b66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bab1f30a726af13b0834d93f505d9331ab10d5735cdc818c0140a3f07ac93b66
SHA3-384 hash: ba33f08a4c0b12199003ef74392b3d90c65b74c6f9f96cfa87fb7c7a9282873fa9b98e4de208013839d169b8b2e95720
SHA1 hash: 17ca76bf80ac201e906a1e6614793904b5639b80
MD5 hash: fa6ce59107780225e9eed2abe066776f
humanhash: cardinal-lake-mockingbird-yankee
File name:fa6ce59107780225e9eed2abe066776f.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:388'096 bytes
First seen:2022-05-23 17:26:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd71e6830e4ca551ccc7d336e27533e1 (1 x RedLineStealer)
ssdeep 6144:4IibZ/7lTPx5LdOJZAYTTlKhInff3pd6IrImkCtEksByc3/5lBAPglwyNR:4RZDlPXhOJpTlFnff5dpACtErByc3Rjh
Threatray 5'624 similar samples on MalwareBazaar
TLSH T15184BE10BAA0C035F1B711F48575A3A8B93DFEA1AB2451CB52C56ADE5638FE4EC3131B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9824e790c4e72158 (31 x RedLineStealer, 18 x Smoke Loader, 16 x ArkeiStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.75:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.75:81 https://threatfox.abuse.ch/ioc/627920/

Intelligence

File Origin
# of uploads :
1
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
fa6ce59107780225e9eed2abe066776f.exe
Verdict:
Malicious activity
Analysis date:
2022-05-23 17:32:21 UTC
Tags:
redline
Link:
https://app.any.run/tasks/da85a023-c2ff-44c3-b363-9a7d1ae1dbae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/273829/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19732/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/628bc402054dcf0ecae3ff83/reports/8974861c-2ce4-495a-a97a-1f6b981dff9d/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d434338c-56f2-4c4f-b0db-d16f27413852
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1000077
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bab1f30a726af13b0834d93f505d9331ab10d5735cdc818c0140a3f07ac93b66/
Threat name:
Win32.Trojan.Raccrypt
Create hunting rule
Status:
Malicious
First seen:
2022-05-23 17:06:56 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xky7gctsnlytwcbu3e7vaxmtggvrbvltltoiddabicr7a6wjhnta._file
Verdict:
malicious
Similar samples:
11f864b4614cb3265b353220873deb49b07153a9d7547de3b15c2e95742a7798
RedLineStealer
23b1b84e17f913198de036137db4ee2207f8c1c94a747b130d0cca0644bc330e
RedLineStealer
831890c5dae911036233eccb29c335cc013affe4bcb77104a7c05374d8fffebb
RedLineStealer
8fe90f9a21cf8dc1a12a65981181a379ed9fff48b212a77c4897cbfaee7cac7b
RedLineStealer
b2a09ad10595641bc731dd1ced0cb493d47663894ba57da9a941031d1a73ce8a
RedLineStealer
cff9a1b58d27045ffbe799d15b1735af2c99dbc233040ad8e1f6be71c821578b
RedLineStealer
+ 5'614 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:top infostealer
Link:
https://tria.ge/reports/220523-v1d2daghg4/
Behaviour
Suspicious use of AdjustPrivilegeToken
RedLine
Malware Config
C2 Extraction:
185.215.113.75:81
Unpacked files
SH256 hash:
75b27f7a8d30a39c8a89813e8f8eb28008e67101059ee431202759c8005e22b9
MD5 hash:
bd52da416e929cbaf72f5818ae2db3e0
SHA1 hash:
e88b7c7fc82c416e0a4f265c3f8f2c48f4e02d02
Link:
https://www.unpac.me/results/7d650ad4-f56b-4a45-b56c-7e97845ca631/
SH256 hash:
7790633e87a2859058722cd3832cd48673764662c42843b571ef7b23d42d6af5
MD5 hash:
ac4b533abcac25825d105557228c179c
SHA1 hash:
a49cb09b05116cfd23f94f9feaeab8dbe8bc8b1d
Link:
https://www.unpac.me/results/7d650ad4-f56b-4a45-b56c-7e97845ca631/
SH256 hash:
c8f30471b80bfda9ef30da1d9ad3ed392a5f2ac01154dd31595efd520c5f8640
MD5 hash:
447622168d44082180805aa7ff673f81
SHA1 hash:
08efebddfa7efb874fdcfbfaa70f447ff3a3fdc4
Link:
https://www.unpac.me/results/7d650ad4-f56b-4a45-b56c-7e97845ca631/
SH256 hash:
bab1f30a726af13b0834d93f505d9331ab10d5735cdc818c0140a3f07ac93b66
MD5 hash:
fa6ce59107780225e9eed2abe066776f
SHA1 hash:
17ca76bf80ac201e906a1e6614793904b5639b80
Link:
https://www.unpac.me/results/7d650ad4-f56b-4a45-b56c-7e97845ca631/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bab1f30a726a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bab1f30a726af13b0834d93f505d9331ab10d5735cdc818c0140a3f07ac93b66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe bab1f30a726af13b0834d93f505d9331ab10d5735cdc818c0140a3f07ac93b66

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2206473/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/273829/

Comments