MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1a3eb518cc279036090506722e5754752278934587d8d6c2e6282825a9c5b33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 1 File information Comments 1

SHA256 hash:	d1a3eb518cc279036090506722e5754752278934587d8d6c2e6282825a9c5b33
SHA3-384 hash:	76edb3a2fdde69bc8c456f7732b83ab8a935ae781a971b8b3f5b44c8bed5975a9af7f6c47979417f137e5595ddead8e5
SHA1 hash:	704a6a04fdcf0dd666b66fc252b7a61a96f830ad
MD5 hash:	03c39436f1f67f47e1b29967d2e040e7
humanhash:	yankee-delta-aspen-twelve
File name:	03c39436f1f67f47e1b29967d2e040e7
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	2'644'528 bytes
First seen:	2022-03-23 01:47:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7f202152ef7611b15765383169e656a1 (4 x RedLineStealer)
ssdeep	49152:OWZA7GntkM3LkLF71JxFUxkpQgAuG2dfTN2SNN4fQL8ed2cZ58yCPxOW+ulyBApy:OsA7CtgF7rxFHpicZ5NN4YdH58ynb6py
Threatray	2'838 similar samples on MalwareBazaar
TLSH	T1C1C523A791B863A7E46393348DD1A91EF3F2344A8B2793AB1311DBA65D037E09C74317
File icon (PE):
dhash icon	6192a6a6a6a6c401 (17 x RedLineStealer, 11 x PythonStealer, 9 x DCRat)
Reporter	zbetcheckin
Tags:	exe RedLineStealer signed

Code Signing Certificate

Organisation:	Google LLC
Issuer:	Google LLC
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-03-14T00:00:00Z
Valid to:	2024-03-14T00:00:00Z
Serial number:	111505a89f16dd26
Intelligence:	4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	dcc71c04432dc860dd824d5bd9af349aa49d073394be4a9ae9aabf6c50227b2b
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
62.204.41.199:30941	https://threatfox.abuse.ch/ioc/439167/

Intelligence

File Origin

# of uploads :

# of downloads :

238

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/255230/

Detection(s):

SecuriteInfo.com.BAT.Starter.366.10493.31536.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Moving a file to the %temp% subdirectory

Creating a process from a recently created file

Replacing files

Enabling the 'hidden' option for files in the %temp% directory

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Unauthorized injection to a recently created process

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/10584/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

keylogger overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/623a7c5bb94fb38cb4d4640f/reports/5eb37771-7d13-4db3-9ce5-73d6e2860bee/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/738201d0-4943-4fc4-8ac4-d8d51748dc19

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/962259

Signature

Antivirus detection for dropped file

Connects to many ports of the same IP (likely port scanning)

Found malware configuration

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d1a3eb518cc279036090506722e5754752278934587d8d6c2e6282825a9c5b33/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2022-03-22 12:39:33 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 27 (40.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2gr6wummyj4qgyeqkbtsfzlvi5jcpcjulb6y23bomkbiewu4lmzq._file

Verdict:

malicious

RedLineStealer

381517605def58f63a5aabe969f824b399e16c952042d3d549bf4a276d433eb5

RedLineStealer

863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327

RedLineStealer

b50d346307ef27c92bf6e5fda61bf060e00ab50119b50facb34cad30747f7c8e

RedLineStealer

dac434ec87d2d83b5426f13247201e8d8826133fc445a4468f4fdc49b19eea2c

RedLineStealer

fc45aada4dd0fd54fea4854bd07276881f46b469cc248146d1772188a5704384

RedLineStealer

+ 2'828 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:3 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/220323-b76kesdfa2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: CmdExeWriteProcessMemorySpam

Enumerates physical storage devices

Drops file in System32 directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

RedLine

RedLine Payload

Malware Config

C2 Extraction:

62.204.41.199:30941

Unpacked files

SH256 hash:

d1a3eb518cc279036090506722e5754752278934587d8d6c2e6282825a9c5b33

MD5 hash:

03c39436f1f67f47e1b29967d2e040e7

SHA1 hash:

704a6a04fdcf0dd666b66fc252b7a61a96f830ad

Link:

https://www.unpac.me/results/92cd044a-dbc2-46ee-80d3-9fdab721c50e/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/d1a3eb518cc2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d1a3eb518cc279036090506722e5754752278934587d8d6c2e6282825a9c5b33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.