MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5b06d0832b539d37783f88f75f396477c53415b8c1ba08eda548211af1b303c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 5 File information Comments

SHA256 hash:	c5b06d0832b539d37783f88f75f396477c53415b8c1ba08eda548211af1b303c
SHA3-384 hash:	914a512088695c9732fd4851426fbe4bbba2e559a1ad8e14cfee916da9bc22a215f68222895baa729d41d42f19127204
SHA1 hash:	2caf4e1ee07d3ce34c904f41b40fe09806a9bf48
MD5 hash:	7ed148a36d93e440ff0db127b3d3e971
humanhash:	louisiana-steak-mirror-orange
File name:	7ed148a36d93e440ff0db127b3d3e971.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	292'248 bytes
First seen:	2023-03-14 20:05:23 UTC
Last seen:	2023-03-14 21:30:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	43f7ea495c8b275ba41e03ccb9017646 (2 x RedLineStealer, 1 x Vidar, 1 x Babuk)
ssdeep	3072:LilFSVR9T3OByhIBLgorjwU0nMAcN60QkZM8bJprnmAG3gEGYw1kTSjN:Lil879iBWrM5AFnt3g6yh
Threatray	2'048 similar samples on MalwareBazaar
TLSH	T14F544A6375D38222E0A7D9FE16E656180BDA9D042624260EF99C4FC3A746EF0357F237
TrID	39.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.5% (.SCR) Windows screen saver (13097/50/3) 13.3% (.EXE) Win64 Executable (generic) (10523/12/4) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
135.181.173.163:4323

Intelligence

File Origin

# of uploads :

# of downloads :

239

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

7ed148a36d93e440ff0db127b3d3e971.exe

Verdict:

Malicious activity

Analysis date:

2023-03-14 20:06:46 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/da2ff7f4-5eb1-42f7-9673-b08db1f21336

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/374389/

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.24392.17392.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Searching for the window

Stealing user critical data

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/73178/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/6410d3ab06c49bd8b6b5c6b4/reports/d3d99bec-2dee-4b08-b232-4db51ff9b369/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/c5b06d0832b539d37783f88f75f396477c53415b8c1ba08eda548211af1b303c

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a91d1672-00cd-42cc-b36b-b5059be91543

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1193683

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c5b06d0832b539d37783f88f75f396477c53415b8c1ba08eda548211af1b303c/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2023-03-14 20:06:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ywyg2cbswu45g54d7chxl44wi56fgqk3rqn2bdw2ksbbdly3ga6a._file

Verdict:

malicious

RedLineStealer

2fc103f91f638b1a26952d2080f7591546a38bb7f712d86e87c6cbcd92ddb5c4

RedLineStealer

34db61f23c2701386292bb8c50ee4a0a425051a255335b07c17a880aa185666a

RedLineStealer

44e737d9bd192f389094c526a51301f3e18875b2afe014b651edc9de75f9d065

RedLineStealer

5331428611e6a398284611837de8d995d012abbc444f69acfdfb370ef6655f88

RedLineStealer

711e3aaa29ad4bb5581bff65bf3e8d67c4afe4a855dbbe19526cbb1e7f6e0992

RedLineStealer

794e9d3b0cd0b4c594e0fdc955b76d3ed2ced25670f35a50b6848b2739425a94

RedLineStealer

87b73e834c2705c1e20ad08ddce868a8703a0f27d2e7749863bc06f55d0cfe14

RedLineStealer

cc9faa4d1d9909f267a14006282af5bf3a16bc25fd056c34a8481bfdf1586907

RedLineStealer

dfe8b10d567d99e44deed014c4f686a1d28fecf9d763ecaefd24916551a75707

RedLineStealer

+ 2'038 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer spyware

Link:

https://tria.ge/reports/230314-yvebqsbe4v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

Malware Config

C2 Extraction:

135.181.173.163:4323

Unpacked files

SH256 hash:

20575c0481164513317f52ef6a1e34ed85db04dd55470d4c1d3ab90d687c6343

MD5 hash:

e7fc64784b839991dea95ade3a7cf30a

SHA1 hash:

efd4748cbfb5fca454bc36506040e171ac7394b8

Detections:

redline

Link:

https://www.unpac.me/results/67036642-4af0-4a72-b9a9-6b3333b5518f/

SH256 hash:

c5b06d0832b539d37783f88f75f396477c53415b8c1ba08eda548211af1b303c

MD5 hash:

7ed148a36d93e440ff0db127b3d3e971

SHA1 hash:

2caf4e1ee07d3ce34c904f41b40fe09806a9bf48

Link:

https://www.unpac.me/results/67036642-4af0-4a72-b9a9-6b3333b5518f/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c5b06d0832b5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c5b06d0832b539d37783f88f75f396477c53415b8c1ba08eda548211af1b303c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Win32_Trojan_RedLineStealer Create hunting rule
Author:	Netskope Threat Labs
Description:	Identifies RedLine Stealer samples
Reference:	deb95cae4ba26dfba536402318154405