MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d561dfe74cc927428dad121c5a8d60f0289a43382e6130bc72a6b34c000b9b9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 9
| SHA256 hash: | d561dfe74cc927428dad121c5a8d60f0289a43382e6130bc72a6b34c000b9b9b |
|---|---|
| SHA3-384 hash: | ce644fa5339984a095713f26851d7fb512b6261bb4350b7a48048383284ca8e55145caa44e43107fc8fd6d2b8540cdc5 |
| SHA1 hash: | 8088d039c151e20ac5b9af29e1dd81116673f4b2 |
| MD5 hash: | 2f414fb976ac1d23daaa8e00aaf6beea |
| humanhash: | juliet-jersey-artist-cardinal |
| File name: | 2F414FB976AC1D23DAAA8E00AAF6BEEA.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 4'288'512 bytes |
| First seen: | 2021-07-30 19:46:07 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a1a66d588dcf1394354ebf6ec400c223 (49 x RedLineStealer, 7 x CryptBot, 4 x AZORult) |
| ssdeep | 98304:G1EESMlQ/9IsCMdegeFbD+dQ5oVOAoso2iFugO+Nthm5mBz:G1EEP42s1cgzKoVK2iFtOWHmOz |
| Threatray | 1'645 similar samples on MalwareBazaar |
| TLSH | T1C9163312A9DE5AB2E03629309418B35B84B58F155B404BA347F93D3F0A709E9DB3F2D7 |
| dhash icon | 00c896968eaaa200 (2 x RedLineStealer) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 172.67.180.172:80 | https://threatfox.abuse.ch/ioc/164948/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
584
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2F414FB976AC1D23DAAA8E00AAF6BEEA.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-30 19:47:11 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Contains functionality to register a low level keyboard hook
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Dropper.7Drop
Status:
Malicious
First seen:
2021-07-27 00:58:28 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
3/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1'635 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:adsbb discovery evasion infostealer persistence spyware stealer
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies system certificate store
Runs net.exe
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
autoit_exe
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Modifies WinLogon
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies RDP port number used by Windows
Modifies Windows Firewall
Sets DLL path for service in the registry
Grants admin privileges
RedLine
RedLine Payload
Malware Config
C2 Extraction:
21jhss.club:80
Unpacked files
SH256 hash:
00b339642177627432e9408b9b084bde1e4456e7045a38395492dd43b34b8b19
MD5 hash:
ad3b1a23ee2c25ef5160da22d1a3e986
SHA1 hash:
94bbfd191acef5007f31db47118ae295931f1930
SH256 hash:
d725e2e597be0a0ed94069700142e046d4f0d430d5f812aab40d27a8b4eb13eb
MD5 hash:
bec5f94ba4caa505c41667e9f4a34bda
SHA1 hash:
3fe89c59685e2730d444827cfdd14da342ff7ea0
SH256 hash:
d561dfe74cc927428dad121c5a8d60f0289a43382e6130bc72a6b34c000b9b9b
MD5 hash:
2f414fb976ac1d23daaa8e00aaf6beea
SHA1 hash:
8088d039c151e20ac5b9af29e1dd81116673f4b2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.