MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
SHA3-384 hash: 64f5c03543687a1e13838296dba394586190240fb66db80c269e06ca486e6f29e008565685ab776fbb8d5e54bed53cd6
SHA1 hash: cc3825f830a679ee0cc80d18ed7809c75cf1ec65
MD5 hash: c443d891edb8a3f196c2b6c8ae6a8feb
humanhash: nevada-spring-ohio-winner
File name:c443d891edb8a3f196c2b6c8ae6a8feb.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:310'784 bytes
First seen:2023-02-05 09:30:11 UTC
Last seen:2023-02-05 11:29:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 504c076db7a7f0918d6f0714c54ff280 (1 x RedLineStealer)
ssdeep 6144:OFMhoVLvSDg9YMQD6ul0ewO0XvUhDEGErEHGwTpT:OFMhoV7SDg8xKO0X8D7qEH
Threatray 16'028 similar samples on MalwareBazaar
TLSH T16464F12237D0D432C4BB55319824E7A1ABBAB53062B8995777B90F7E8F312D09B39347
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 816a6e6a6a6a6a70 (20 x Smoke Loader, 18 x RedLineStealer, 3 x Amadey)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
62.204.41.170:4172

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
c443d891edb8a3f196c2b6c8ae6a8feb.exe
Verdict:
Malicious activity
Analysis date:
2023-02-05 09:31:50 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/8ac33841-ea7f-4a8e-9b5a-334d1a6cf0fe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/360379/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.268.11971.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63df77562d4f6d560e244950/reports/f8843bbd-c736-4f7f-a465-eb6ea43160c8/overview
Verdict:
Malicious
Labled as:
Ransom.51A80467
Link:
https://www.hybrid-analysis.com/sample/d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2d0713cb-ff9f-49a3-984f-9c02e559cb00
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1165982
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2023-02-05 09:31:05 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uwm36h7b525gnywpnr3onwdveemjdfpno6ttisdjyf2vra655xq._file
Verdict:
malicious
Similar samples:
09b749cb035fd17bc749c1738d1f35f35500df7b157552f26f7570d80f8acde1
RedLineStealer
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
RedLineStealer
2fc20c39599a1a7f6d4bfda33562581622c15a3a7a92db8185b6de41eba56ed1
RedLineStealer
6fbf44183c6ed6ebe3f188f187afe712574c34d9787cdf40c5bcbb07f6d50fb7
RedLineStealer
98b338db8e45e180cdc512c6dc83128354d3a6f64f5da8d538963dcc9c6a2342
RedLineStealer
cdfdc2becd5e3531a967dc8356ea89d087826f53e320c98bb569dcfed1b2cae5
RedLineStealer
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
RedLineStealer
ef837e4549085f90fccd5b3a25082480ea20102458889ea8576c2714404086ea
RedLineStealer
f3162a139191ee7ab512dc14be6002712818fb4b00a3de5dc213d62c6c08beba
RedLineStealer
fd175c2b3abdea1356f213078f594cd33d643c39ce9db3360f30263bbafa90c9
RedLineStealer
+ 16'018 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:zaur discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230205-lg2hwscc9v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
62.204.41.170:4172
Unpacked files
SH256 hash:
bd306f1eb9573ca90c359ba059a7ee3e4f2fa81b94886544efbc70fab6b0c529
MD5 hash:
cf661fb505ff59ab4942e70962ff54ce
SHA1 hash:
8eea31a315019e342388a838ab256c4da990b5dd
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/442b88e1-67b1-4988-affb-450b17dbd69e/
Parent samples :
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
7becab35b4300ad3c0be8e7dc12f311b140cb8a7b5338e0102fcf6f71c97157d
15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
1498389b39bb5db52d583bc40f9e021934d53bbf8b363809ca0d4e58f9ba30ef
fcc8a1cd9b32433a8735fae44718bc36b2ea00b96df212c9d63186031d7af10d
ebd46441b3e3a1c1e64d6b0952dacb9bcdd896bb95c8a62bc3a4028a58b1573c
0e36e23f795621dce7b398b59cbb4db16683da88e133210f1bb17879b1dc94a6
SH256 hash:
2a62ac253b6cd959b7131d37268d99bc515a09343e985cebda911d403bbf224e
MD5 hash:
314b2f270faf2d3af32447d1a19e873e
SHA1 hash:
88228152e3351a0cb3906e610fe05787ce814d7c
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/442b88e1-67b1-4988-affb-450b17dbd69e/
Parent samples :
e22263bcc3bad9a4f3b0529461bbd2dd222e9aec73bb36678f0289dea0dde4ca
103f1c25aaac16c39aca36ca629b1ab3b1226170753074ae924f27c0326aff1b
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
7becab35b4300ad3c0be8e7dc12f311b140cb8a7b5338e0102fcf6f71c97157d
15019e74fe93e132d60d4f7fa7f2b23967c6bf0675936c0874117663067f8874
1498389b39bb5db52d583bc40f9e021934d53bbf8b363809ca0d4e58f9ba30ef
fcc8a1cd9b32433a8735fae44718bc36b2ea00b96df212c9d63186031d7af10d
ebd46441b3e3a1c1e64d6b0952dacb9bcdd896bb95c8a62bc3a4028a58b1573c
caf51bbc26408a0d9e3b24595b0318e128b9bc98ce713fa936ffbaadea6a33ad
0e36e23f795621dce7b398b59cbb4db16683da88e133210f1bb17879b1dc94a6
SH256 hash:
7e39c951b6d469fa7e68bdcae3bfd9a98ad100a2b2db55dae88e71640823f65e
MD5 hash:
685932fb80294b302dd6b0910f692421
SHA1 hash:
02193d6758faa9808ef2e5b5e8d96665906d77ba
Link:
https://www.unpac.me/results/442b88e1-67b1-4988-affb-450b17dbd69e/
SH256 hash:
d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f
MD5 hash:
c443d891edb8a3f196c2b6c8ae6a8feb
SHA1 hash:
cc3825f830a679ee0cc80d18ed7809c75cf1ec65
Link:
https://www.unpac.me/results/442b88e1-67b1-4988-affb-450b17dbd69e/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d52ccdf8ff0f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe d52ccdf8ff0f75d337167b63b736c3a908c48caf6bbd39a2434e0baac41eef6f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2528642/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/360379/
  
URLhaus
https://urlhaus.abuse.ch/url/2529227/

Comments