MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c83ec78cb8839b3d4a58647e6e0c301c4d44f62ee2616f61af8374a88b0b1cac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments 1

SHA256 hash:	c83ec78cb8839b3d4a58647e6e0c301c4d44f62ee2616f61af8374a88b0b1cac
SHA3-384 hash:	3f1f1420e5bd3d42afc48a0817f22b028fd2c88ba746f9028094bbd1592eb8d03c526ed56fe63577a988b488af23c124
SHA1 hash:	2f09e09abafa5898db0d5d86819be336aa9f98dd
MD5 hash:	de6a9e2f20b34b20005056e270b216ae
humanhash:	cardinal-fish-helium-saturn
File name:	de6a9e2f20b34b20005056e270b216ae
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	713'040 bytes
First seen:	2021-11-25 21:22:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2c46971a47023ea15cd006665e78aced (1 x RedLineStealer)
ssdeep	12288:ITd8H888888888888W88888888888KlweS35mVxanTQnicyFFlc3D2QxLc8ZbHbQ:ITd8QdS3FQivlc7kfvT
Threatray	188 similar samples on MalwareBazaar
TLSH	T1ACE4D081EF875036E83446385622E664FE133E7980D158263DBDFA8F4BB214748FBD5A
File icon (PE):
dhash icon	b2b271e4a28e0f20 (1 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

de6a9e2f20b34b20005056e270b216ae

Verdict:

Malicious activity

Analysis date:

2021-11-25 21:24:32 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/fc8af628-c973-4b61-86fe-e0aa7f07c4ce

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

SecuriteInfo.com.Variant.Doina.29139.23697.17305.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/619ffebab71ceed4153093e7/reports/d0651577-8b8e-4478-b0a9-f8c5bba57669/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/28111d36-8a68-49e1-a597-8751e88c824b

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/896378

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Detected unpacking (changes PE section rights)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file has nameless sections

Tries to evade analysis by execution special instruction which cause usermode exception

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c83ec78cb8839b3d4a58647e6e0c301c4d44f62ee2616f61af8374a88b0b1cac/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2021-11-25 21:23:11 UTC

File Type:

PE (Exe)

AV detection:

23 of 28 (82.14%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=za7mpdfyqont2ssymr7g4dbqdrguj5ro4jqw6ynpqn2krcyldswa._file

Verdict:

malicious

Label(s):

ryuk

RedLineStealer

3ea20ab6ac71f7252d2f3c4ccac94303b30ab139b812c66b69da08d6969dbe87

RedLineStealer

6a498d84dd0cba5d8e272cbc5cb10382e7fd0da648a345e92c26414ceb5d3dc8

RedLineStealer

899212cef8387993ef7e01d930fd9b946a5531c63ab885f4641b7a3061d05f73

RedLineStealer

ed58793bc31fa9098152a7d5e1e473ab50be287577f639f031aa9adffc040103

RedLineStealer

ee015d23b3666bf15f57c848a4ca57e58440b611e800718f7419ed189a5022ca

RedLineStealer

f0b3267fa660090a9f3008f4fe70f4191d51ec5d087692a0e218a137f10dbaae

RedLineStealer

fbb99570b341367a86c2c23b56862bfb3d3ea91c06e7c15750f7d36bf82f494b

RedLineStealer

+ 178 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer

Link:

https://tria.ge/reports/211125-z8fx6acaf5/

Behaviour

RedLine

RedLine Payload

Unpacked files

SH256 hash:

e8ae01daa7d2173dac2b7bbac968c56885cedb89c908ecca1cc4494999dd944f

MD5 hash:

7f6956f115ebd0072343d2469a97eb5d

SHA1 hash:

8da371851993a5b6f34b1969c9612c20b376dc34

Link:

https://www.unpac.me/results/4797a4f4-bcd2-4a5c-afc5-38e3dc68c624/

SH256 hash:

c83ec78cb8839b3d4a58647e6e0c301c4d44f62ee2616f61af8374a88b0b1cac

MD5 hash:

de6a9e2f20b34b20005056e270b216ae

SHA1 hash:

2f09e09abafa5898db0d5d86819be336aa9f98dd

Link:

https://www.unpac.me/results/4797a4f4-bcd2-4a5c-afc5-38e3dc68c624/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/c83ec78cb883/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c83ec78cb8839b3d4a58647e6e0c301c4d44f62ee2616f61af8374a88b0b1cac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time