MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694
SHA3-384 hash: 44443d0968af30c9d9bc56abfa83d2188980d59673496d0c0cd68d605840c716632c9bdf7d7d1dcc1a9e6a9c7180acb4
SHA1 hash: e7b62657fb7f707beaf38f1d1063691ed2c57d8d
MD5 hash: 4688225e63fefcf0b95378bd013589f7
humanhash: black-leopard-mississippi-oregon
File name:4688225e63fefcf0b95378bd013589f7
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:107'008 bytes
First seen:2021-09-20 09:59:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:mXq0GF3ioT5LoAOjyA+fbmgJ80ymd/AVpYB:h01cbmgJtyMC
Threatray 1'642 similar samples on MalwareBazaar
TLSH T16AA33A2913BCAB35F6BE6B792460051583F4E08BA812EF5F9DC054DA3F22F41A6546F2
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4688225e63fefcf0b95378bd013589f7
Verdict:
Suspicious activity
Analysis date:
2021-09-20 10:01:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/697b3ed6-2080-4edd-9b0f-9ca8d7088139

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189381/
Detection(s):
Win.Packed.Bulz-9883367-0
Create hunting rule

Win.Packed.Bulz-9888336-0
Create hunting rule

Win.Packed.Bulz-9891195-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f3178620-e7ed-4cf1-8d91-f957b446a2a6
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/853907
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to capture screen (.Net source)
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694/
Threat name:
ByteCode-MSIL.Infostealer.RedLine
Create hunting rule
Status:
Malicious
First seen:
2021-09-18 21:03:00 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yf2r3fl6py2b5b7ccymkntjokztghagrtnfy5b3gwhqa4hnru2ka._file
Verdict:
malicious
Similar samples:
51bf9ff43b1aedfebfcf03c71e5bba10a6704b2cf4503e5bbe680221652cc458
RedLineStealer
65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
RedLineStealer
7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587
RedLineStealer
a32770d46ee2ee5b91cc36e5159868ec3ff7f847e7516d7bcb952f7a94e347a2
RedLineStealer
a354c672e502b1f84041b96c0db87f9f63868908ab01a9d993476854de4834a7
RedLineStealer
a5c940653c3b19cacd1378f2081feb377f2791257fbef36cd64df3a0b1b7d4b4
RedLineStealer
ab2851b9d96065b01a96c3305a8bbec77522b97a6c751a82a34f47f45f30af6a
RedLineStealer
cfcb21c8c129c8c2c525ecfac8bd883260eda6038e3991210765e582007451dd
RedLineStealer
ea53c010ce06e14caea95012ec3f26a30e7e076c6b349263f52676480f925c8a
RedLineStealer
f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6
RedLineStealer
+ 1'632 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@xxxidss
Link:
https://tria.ge/reports/210920-l1nq5sdfa2/
Malware Config
C2 Extraction:
45.137.190.170:19896
Unpacked files
SH256 hash:
c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694
MD5 hash:
4688225e63fefcf0b95378bd013589f7
SHA1 hash:
e7b62657fb7f707beaf38f1d1063691ed2c57d8d
Link:
https://www.unpac.me/results/981e43a1-9e5a-4a2f-a111-987f4f41b36c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe c1751d957e7e341e87e21618a6cd2e56666380d19b4b8e8766b1e00e1db1a694

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/189381/
  
URLhaus
https://urlhaus.abuse.ch/url/1635120/

Comments


Avatar
zbet commented on 2021-09-20 09:59:40 UTC

url : hxxp://103.169.90.205/blog/upload/6.exe