MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
SHA3-384 hash: 53093b51e99439329fabbf7c0a63f2ff78072db95bcc6dfdc6ec3771f12ea27485c01f32989e3183b0c61059b2048c36
SHA1 hash: 880af1b339ed093f20652de3e71c5c06f4bb8843
MD5 hash: 3e3fd9a5d1491021d0458bbfe076304a
humanhash: alabama-equal-south-nineteen
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:410'112 bytes
First seen:2023-02-02 14:00:51 UTC
Last seen:2023-02-02 14:29:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d9bb3534629ee1e0adad5f89cd30d412 (2 x RedLineStealer, 1 x Smoke Loader)
ssdeep 6144:vz3L76bhCDyUXwISmej8dhV6jqq7guo32TSEj9/CJTk637eQfnd58ABD:bHBDZXQmrT6u3uWqnj9CJb7d5
TLSH T14B94AF42B2E1BC49E9318B728F1EE6E4791FB9518F5837B61314AA1F18711E1CBB3325
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2665220a26250c40 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://194.110.203.101/puta/brazilx86.exe

Intelligence

File Origin
# of uploads :
14
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-02-02 14:04:02 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/705a3fac-3beb-4352-b1ea-eaa1746e03a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/359558/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/63dbc21e905a5ac3b9095832/reports/f23660cc-bb03-48f6-a49f-9b851a714686/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6978ee12-0a1a-40e8-a3c7-e3e74769b443
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1164282
Signature
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2023-02-02 14:01:06 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2paswqas5b773eua7z7ntjh2kwrasciczrgwfdadpz6ah4lzpvvq._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:2-2-2023@ discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230202-rbh29acb95/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
91.215.85.155:32796
Unpacked files
SH256 hash:
02d15cc70446bda384a483ed4d81e5fd4bf7a2c5848ea5ec355fa693dfff8503
MD5 hash:
b95cc5ff84e75ce7bbc38edf9f0746fa
SHA1 hash:
a3c4b7ea0200305a45cd6214ec63ec6948dfb6b8
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/f5c5b5ab-b036-41a9-976d-9ffb744fc42c/
Parent samples :
ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
5243496a6317fa28696043916abcda8a598d9e4b3d101a04d8eb33c8f998d227
MD5 hash:
fa49d962de59c209b6f269007a1dfb49
SHA1 hash:
322a177a0031221ebec3dc788166e4946363f830
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/f5c5b5ab-b036-41a9-976d-9ffb744fc42c/
Parent samples :
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SH256 hash:
a09bb30e4ac852eeb4fbfe3c4900606f83775936b6be3c175c4dc773376a273b
MD5 hash:
135d8693f5bddda089165c5d0461cf8e
SHA1 hash:
0b93c573787c2bbd9f6dc0a5aecacd95d271d3de
Link:
https://www.unpac.me/results/f5c5b5ab-b036-41a9-976d-9ffb744fc42c/
SH256 hash:
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
MD5 hash:
3e3fd9a5d1491021d0458bbfe076304a
SHA1 hash:
880af1b339ed093f20652de3e71c5c06f4bb8843
Link:
https://www.unpac.me/results/f5c5b5ab-b036-41a9-976d-9ffb744fc42c/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d3c12b4012e8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/359558/

Comments