MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0fe41fb6c2ff9e04d8c071514f542f493003b34f4da462866402a42d02f459f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	c0fe41fb6c2ff9e04d8c071514f542f493003b34f4da462866402a42d02f459f
SHA3-384 hash:	dbb72a9e15b426283cc599ab1aa2749224690905883f9e31516f643ab55e40de0a993a6d27affce19adb7f88b2c81793
SHA1 hash:	a2e460dac818ddee85445471e01215b585bce688
MD5 hash:	ab65b26d42f98dbc6933d96c45b01774
humanhash:	thirteen-mars-tennis-johnny
File name:	ab65b26d42f98dbc6933d96c45b01774.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	396'288 bytes
First seen:	2021-10-04 16:05:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f47739d0cfd89d51cbbbec502f2604c9 (6 x RaccoonStealer, 2 x RedLineStealer, 1 x Loki)
ssdeep	6144:yufXEnYR4tz5xxVMj1Lj7fMZ5tfjwOuhiPORROhxxpeTr/ekI:r/EtlxwjZ+5JjhXPOGzxp6L
Threatray	2'596 similar samples on MalwareBazaar
TLSH	T15D84E0093191D7F2D7B20531AB66C3F44A6DBC6D5D2A164F3B89272E6E393F29631302
File icon (PE):
dhash icon	fcfcd4f4d4dcd8c0 (34 x RaccoonStealer, 21 x RedLineStealer, 8 x ArkeiStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

382

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ab65b26d42f98dbc6933d96c45b01774.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-04 16:09:48 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c8401738-7a4c-4305-883d-fee3f03c88cf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/194734/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen3.3334.25964.18475.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cd44e47b-4355-462b-9889-208ac572e070

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/864131

Signature

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c0fe41fb6c2ff9e04d8c071514f542f493003b34f4da462866402a42d02f459f/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-10-04 10:53:12 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yd7ed63mf746atmma4krj5kc6sjqaozu6tnemkdgiavefubpiwpq._file

Verdict:

malicious

RedLineStealer

2acb4c85d29625922f70b618144eb81f4427998aa52c06e2130527972a8bc0bb

RedLineStealer

3204893e4ca6c06b774a07b92f9a021fc073f2c630d0a62ecb2efeaeacc89556

RedLineStealer

9351b3d3a5b780220b67f06c7cb9b8d49a95055f6aa0934b733b0208458cfa6f

RedLineStealer

9b9b66a158beacb1a23877ab25c70435a43f072f76a0ba35fed9ad32f781d04c

RedLineStealer

ac098ff6d0aab414dad2bce4a4a21ade100a6d4921bf90c7890409b8d37dea05

RedLineStealer

b86ef6990c59e33deca76103b740084871993a9c417b2b802c608c7604ea8b25

RedLineStealer

c033668e5a3c82e261b344df51117a1acca8a6eda9668c4fd854d5af8e6681a1

RedLineStealer

c3c719df023aac77ba10e9f8c21000f21b710b5804868ca35ddca62a7b2f9b4d

RedLineStealer

f1a569c0cacca1b3440f4cc2f22898a032c52c92245d9059be57e336510fdb5e

RedLineStealer

+ 2'586 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:paladin infostealer

Link:

https://tria.ge/reports/211004-tj58vsggar/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

178.63.26.132:29795

Unpacked files

SH256 hash:

369173cd39240e2bcfea6193f8c61a7a7d64d7fe3518748abe35ddaf9a47bee4

MD5 hash:

d4c01e4a11d5f3a15d1238adac75341b

SHA1 hash:

7f03fe7ab42282ff8d71f08ef864ec91dcc7e820

Link:

https://www.unpac.me/results/55766cc6-2700-4d95-922f-91f2b7d2d050/

SH256 hash:

7d80bb48dbc775cdfff203da1d4450ec57c22375d4ba2f917b5425cdbdd41831

MD5 hash:

b830b6f7c2c026ce163a9bda0d44b570

SHA1 hash:

5e3231d95c99d2582f6b60d89cec37e57717d1c6

Link:

https://www.unpac.me/results/55766cc6-2700-4d95-922f-91f2b7d2d050/

SH256 hash:

b439f898061b04fa803f826b57c330336f93dbe6949e27ad0da86422781ffb7d

MD5 hash:

19f232c33a1c2f36c26dd4b9b7fe3001

SHA1 hash:

155928c673cf5dec3b558783da746fead5526368

Link:

https://www.unpac.me/results/55766cc6-2700-4d95-922f-91f2b7d2d050/

SH256 hash:

c0fe41fb6c2ff9e04d8c071514f542f493003b34f4da462866402a42d02f459f

MD5 hash:

ab65b26d42f98dbc6933d96c45b01774

SHA1 hash:

a2e460dac818ddee85445471e01215b585bce688

Link:

https://www.unpac.me/results/55766cc6-2700-4d95-922f-91f2b7d2d050/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/c0fe41fb6c2f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c0fe41fb6c2ff9e04d8c071514f542f493003b34f4da462866402a42d02f459f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.