MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdd8cb16847a0fa38d857113ce50a46b1a9fe40e8409bacd684d829bebe94844. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	bdd8cb16847a0fa38d857113ce50a46b1a9fe40e8409bacd684d829bebe94844
SHA3-384 hash:	6e92533e2f49577e18c6bff8aca6207556667b0daf24b94a2b38dc1b67f2c1d1fdf95bbbeeca07b8f523a94d2b073ab2
SHA1 hash:	10d326c24d26c843df711f717594f4138d099eb7
MD5 hash:	c76708bb509f9b8489e5c9ea29558c1f
humanhash:	vegan-eight-muppet-delta
File name:	c76708bb509f9b8489e5c9ea29558c1f
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	299'008 bytes
First seen:	2021-11-10 12:56:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c8cafda4e053c1cc53231f2d3aff32c4 (3 x RedLineStealer, 1 x Smoke Loader)
ssdeep	6144:YtVHxDZV2JwUCdFK9JMkUwlL/W3AiWcpxfTuzbgwujiga:YtVHxV7W9U0/ONpx7unnb
Threatray	2'988 similar samples on MalwareBazaar
TLSH	T1DB54CFF136AD8633D1A70E31997086B04A3B78736960414AE7B46B2E2E70FDC95E534F
File icon (PE):
dhash icon	fcfcd4d4d4d4d8c0 (75 x RedLineStealer, 56 x RaccoonStealer, 23 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/204715/

Detection(s):

Win.Malware.Fragtor-9907126-0

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit packed

Link:

https://www.filescan.io/uploads/618bc19fdec3347825a1353e/reports/e39222f7-a5dd-4730-b457-e8b34a65ea8e/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c251c3f6-9afb-46c0-9a9f-56830fce02aa

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/886701

Signature

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bdd8cb16847a0fa38d857113ce50a46b1a9fe40e8409bacd684d829bebe94844/

Threat name:

Win32.Trojan.Injuke

Status:

Malicious

First seen:

2021-11-10 12:57:05 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xxmmwfuepih2hdmfoej44ufenmnj7zaoqqe3vtlijwbjx27jjbca._file

Verdict:

malicious

RedLineStealer

0ed83aa95f87e65e843b791c92419d0c1d34e5b01cc0be01715009f679ddc220

RedLineStealer

121b446992182d929ea152429527662252f30e2a3ee15468a50015760c7c4f0e

RedLineStealer

24bb15d093025a935e0de62e850056aea484990c713517cd53de6696b5e9db52

RedLineStealer

9f322df416d8c350f577677c1654efde29b5bbfc09e2510403953d1af7e37875

RedLineStealer

b460853c5ec595df43a8cb5b67d9e8d41348334060e3766c8c14709e03a826ab

RedLineStealer

b821da19f3f294e14b95e0a9c2b2926fbac983986494e81278ba4d3b7c5502a4

RedLineStealer

bdae4240709c06d733b9d67851a9d5f159102d145ab7f57ab689358a196916bf

RedLineStealer

cc2bef9329a741ecf4c4b92d6af68a78a7de8165b4876d598998abc6dd1a7903

RedLineStealer

+ 2'978 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:superstar infostealer

Link:

https://tria.ge/reports/211110-p6xssaebfl/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

RedLine

RedLine Payload

Malware Config

C2 Extraction:

185.215.113.29:36224

Unpacked files

SH256 hash:

95d1284b38956fb6a9e76c630acce1c37e41177cb6363df6759b31c139f25227

MD5 hash:

85f83ca85cab60c704c1b3d52cbd276d

SHA1 hash:

f3c0408a8bbf38acf5a04c287d9e148d12f341a3

Link:

https://www.unpac.me/results/df34fe36-883e-436f-ad87-83fb3b96d594/

SH256 hash:

eb58744cfd98d6f6c157ed563904b39c05b4a5393894692cbd1be6298d9d2086

MD5 hash:

93ed16d365e472e03681a21e6b053782

SHA1 hash:

cc4be427791cf175a23154a83c0dbf497b280e43

Link:

https://www.unpac.me/results/df34fe36-883e-436f-ad87-83fb3b96d594/

SH256 hash:

530ee932b7e415222c31080326f026a79280df76ab363ca38802a15497f8ce51

MD5 hash:

3c95728f3f0dd3b1511554febac68c1a

SHA1 hash:

c0a34aa26369e0a9ce99c72df75f1141142e430e

Link:

https://www.unpac.me/results/df34fe36-883e-436f-ad87-83fb3b96d594/

SH256 hash:

bdd8cb16847a0fa38d857113ce50a46b1a9fe40e8409bacd684d829bebe94844

MD5 hash:

c76708bb509f9b8489e5c9ea29558c1f

SHA1 hash:

10d326c24d26c843df711f717594f4138d099eb7

Link:

https://www.unpac.me/results/df34fe36-883e-436f-ad87-83fb3b96d594/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/bdd8cb16847a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bdd8cb16847a0fa38d857113ce50a46b1a9fe40e8409bacd684d829bebe94844

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.