MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4fa7e3a47f4d62d9bc0c4608aad5b43fbcb3de3272c891439a3641957bb533d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4fa7e3a47f4d62d9bc0c4608aad5b43fbcb3de3272c891439a3641957bb533d
SHA3-384 hash: 08de7b8327dd00e3df9f3f01c5d12c25ef8259b55bed69d6b2d03e60d4f06df7836b6aac79cf35cb808f76e48876fab7
SHA1 hash: c40e56bc4c77630b51fbe8a45b608c98c19cd421
MD5 hash: fc2b84d5b90063ee6eea1e11a831f125
humanhash: carpet-saturn-leopard-ink
File name:fc2b84d5b90063ee6eea1e11a831f125.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:228'352 bytes
First seen:2021-09-25 09:23:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a33546f5b752a06a4745d4c8006e21b0 (1 x RedLineStealer)
ssdeep 6144:S3lNW7Bm2U/8O+jS1Y9QVKS9MTIsm5yTk:WNUmV/J1Y9QfW8ss
Threatray 3'642 similar samples on MalwareBazaar
TLSH T18324CF2136E1C032D6EB773448B4EBA14BBFB6626774D24F2B542A2E1F222D15A35347
File icon (PE):PE icon
dhash icon b1e8eeb6f6dcf9a6 (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.15:6043

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.15:6043 https://threatfox.abuse.ch/ioc/226451/

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fc2b84d5b90063ee6eea1e11a831f125.exe
Verdict:
Malicious activity
Analysis date:
2021-09-25 09:30:53 UTC
Tags:
trojan rat redline loader opendir evasion stealer
Link:
https://app.any.run/tasks/891664bd-d5dd-4ea2-a601-43b8db7c9b13

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191434/
Detection(s):
Win.Packed.Fragtor-9896091-0
Create hunting rule

Win.Ransomware.Generic-9896092-0
Create hunting rule

Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/69dd4712-a104-46d6-9f28-ad4d843d4da9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/857891
Signature
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4fa7e3a47f4d62d9bc0c4608aad5b43fbcb3de3272c891439a3641957bb533d/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-23 15:40:39 UTC
AV detection:
29 of 45 (64.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2t5h4osh6tlc3g6ayrqivlk3ip54wppde4wisfbzunsbsv53km6q._file
Verdict:
malicious
Similar samples:
15fcf16c0b002ac7f125ed2d81851a1504554164d8b0d5b72d670a73200b8bfb
RedLineStealer
3837bd604e129244d1ca1fdd901fec0de7069f960e4c787c579811e21f2448c2
RedLineStealer
46833cb6d7164e28570005bd33ca5a46e3d1f3666677d1a1ef541b70f98b5d14
RedLineStealer
49113451c4baac2ee6b97486bd1f57dcf68891d55ff4782daa4d578e23e78d7c
RedLineStealer
84e2ad7dc850968e01f5e82dd5f936558580ac0f868d86e3b7d55060c27140ab
RedLineStealer
aab74b8bcca09c0fecb8c23b554d2cb110710d8718de82e63f060860c5a396e7
RedLineStealer
b41de952a4fc93913cc56535c289c1cfd5b4c249477a0fad912956abf6b2293b
RedLineStealer
b9f79bcb4c0ea9e939b35813e807fda308b7038f1dea613e7d8bbd7fe127ac84
RedLineStealer
e95fd4b1c20d7547466b404f5a9f00940e40e3c8421c3838b619adfa6bbcb4cb
RedLineStealer
ef2f21418e6ff5b26def9df5e5a12be498475dcd904e1e11bce087e8fb7037b6
RedLineStealer
+ 3'632 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210925-lc3v6aahh5/
Behaviour
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Deletes itself
Unpacked files
SH256 hash:
eb4c0951d2bae23fe5610e3cc4d32efdfa39d12fbe4922df1b61340cbda1942e
MD5 hash:
31b9aa52f867c7dd74f5308633ae8fcd
SHA1 hash:
7c16b4d86428e53da0a9a7b71e8c3be56c8cdfbb
Link:
https://www.unpac.me/results/1582cafb-28af-4743-b221-9daa6793c7ad/
SH256 hash:
d4fa7e3a47f4d62d9bc0c4608aad5b43fbcb3de3272c891439a3641957bb533d
MD5 hash:
fc2b84d5b90063ee6eea1e11a831f125
SHA1 hash:
c40e56bc4c77630b51fbe8a45b608c98c19cd421
Link:
https://www.unpac.me/results/1582cafb-28af-4743-b221-9daa6793c7ad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4fa7e3a47f4d62d9bc0c4608aad5b43fbcb3de3272c891439a3641957bb533d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/191434/

Comments