MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd55b37d02325fbe745bb454882d40a77e5779529f70ac961370f7abb2bf6b68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	bd55b37d02325fbe745bb454882d40a77e5779529f70ac961370f7abb2bf6b68
SHA3-384 hash:	770b310830d9d8413a2cea4a07196b422d62154012013dd13f753d92a6bd10614255cebcd493eeff82f60afe9bca0dd2
SHA1 hash:	13d1c27c6789f3428e0e24c54d0b28619266985d
MD5 hash:	1aaa05c04ccb186b03c97e7b6ba7fc78
humanhash:	winter-mississippi-sweet-delaware
File name:	1aaa05c04ccb186b03c97e7b6ba7fc78.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	254'464 bytes
First seen:	2021-08-20 07:20:58 UTC
Last seen:	2021-08-20 07:54:52 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9351114812ade0773cab5940b106fe09 (3 x RedLineStealer, 3 x RaccoonStealer, 2 x Amadey)
ssdeep	6144:sAvbk5+BRHurOAFOilFJFjUkzyhtpA7uFb7bvOiIRT46FgFnL:rvPO8c/VFypHbFIx46uZL
Threatray	4'823 similar samples on MalwareBazaar
TLSH	T19544E13278B0C1B6C013557144DAC7E0297EFC218BA5924B3F57EF5E1F72281A626F9A
dhash icon	9072c292b0381802 (2 x RaccoonStealer, 1 x Smoke Loader, 1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1aaa05c04ccb186b03c97e7b6ba7fc78.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-20 07:23:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/02f46d4f-6142-4787-86af-b962d0a939ed

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/180897/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.9685.30362.13806.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c2ea710a-0f96-4044-b162-c3d8e0444624

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/836298

Signature

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Potential time zone aware malware

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd55b37d02325fbe745bb454882d40a77e5779529f70ac961370f7abb2bf6b68/

Threat name:

Win32.Infostealer.RedLine

Status:

Malicious

First seen:

2021-08-20 07:21:03 UTC

AV detection:

24 of 46 (52.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xvk3g7icgjp345c3wrkiqlkau57fo6kst5ykzfqtod32xmv7nnua._file

Verdict:

malicious

RedLineStealer

09d58d081dd9364e99857ac273d52a17a0473cc64e64d0e15b2b9b2f67ef2d49

RedLineStealer

1633c6faf596675fa576e9fbb1acf05bb4a2a7c153f6330039b922d651564773

RedLineStealer

4023763ad7b1f3cae1395dcfbfb15317c006526c355914ecf7d8506696e3b1ce

RedLineStealer

54516b31cdd596a0f688a71a2fb9410ff6c10e79ca4316c02ad906e55fcb1029

RedLineStealer

6ad1cf3b42e1c571f6a7a402ad29e289ea119a6929345660a98e2786a3ddace4

RedLineStealer

786011dec9484fb81863be557b51a2adba291cee4cc6c6f91fd21c2ce94cb1a8

RedLineStealer

8498f560c45b7d2db3427aaf5a481a4e584a1aa8f59767147e895b60e08286cf

RedLineStealer

ebfe4a01a842ddcf434e44a288773454c4c5c35602a5fba3a31e47ff010a1314

RedLineStealer

+ 4'813 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer

Link:

https://tria.ge/reports/210820-3wz3a5xree/

Behaviour

Suspicious use of AdjustPrivilegeToken

RedLine

RedLine Payload

Malware Config

C2 Extraction:

193.38.55.35:16777

Unpacked files

SH256 hash:

20f51a8b7ba18cc060bb9411823d577c19e88e983147b8b019fb9840a747c4d5

MD5 hash:

bd51375220d31f518644f2987e0042ed

SHA1 hash:

ca214e38bccb9980215ef79312bb5b58424e19f7

Link:

https://www.unpac.me/results/7ad83972-d29b-44f9-9e71-f8bd389ea5fe/

SH256 hash:

a6ee0de5bb46d40154cc214ef9f8c411a5469568e84397921254ff354efe14c0

MD5 hash:

775fd6474f9d6262dd5aefd4d01e264d

SHA1 hash:

7fd7eb607ec54bc56401dcf730551b77107dd2b9

Link:

https://www.unpac.me/results/7ad83972-d29b-44f9-9e71-f8bd389ea5fe/

SH256 hash:

6a0ca824a72a8436be3fff2f37cc88240bd0c56594892ad473fa87b08b2f114a

MD5 hash:

9901bc810dad8840ac9aaa81cc26b332

SHA1 hash:

67683cf20bd4ab774c78978093ad5ff0506de8bd

Link:

https://www.unpac.me/results/7ad83972-d29b-44f9-9e71-f8bd389ea5fe/

SH256 hash:

bd55b37d02325fbe745bb454882d40a77e5779529f70ac961370f7abb2bf6b68

MD5 hash:

1aaa05c04ccb186b03c97e7b6ba7fc78

SHA1 hash:

13d1c27c6789f3428e0e24c54d0b28619266985d

Link:

https://www.unpac.me/results/7ad83972-d29b-44f9-9e71-f8bd389ea5fe/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bd55b37d02325fbe745bb454882d40a77e5779529f70ac961370f7abb2bf6b68

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.