MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
SHA3-384 hash:	bec2ccadd9a0ef6849e10e0b94d8e19de0eb637e3de67026b019a3cfb3520af719fc132be5f703aee8d103d93702f3ea
SHA1 hash:	ffe713b1baa73ca65e7c2a9b88b471f715308526
MD5 hash:	c86be0608ca0a4b00158a845db672d6c
humanhash:	lactose-xray-green-network
File name:	c86be0608ca0a4b00158a845db672d6c.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	411'648 bytes
First seen:	2023-06-29 08:40:08 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c61bedf317f19d715278ea485f1b5899 (3 x RedLineStealer, 1 x Amadey, 1 x GCleaner)
ssdeep	6144:5HllgV77zjFlc/GcI8Xd8vnX+OqO74VQGjbWCfIewt0HNRCrMXsLcH:5Hllw7zjFlWGclQOn1VQsbZRwtERBXq
Threatray	102 similar samples on MalwareBazaar
TLSH	T1C6945DD3A2A17D5CF5254F728E1EC2E4BE1FB9504E4977AA92189B1F04F11B2C2FB610
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	1090504252491000 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
146.59.161.7:36019

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

298

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

c86be0608ca0a4b00158a845db672d6c.exe

Verdict:

Malicious activity

Analysis date:

2023-06-29 08:40:19 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/7079d7d4-70d8-41f9-84a8-a5f0a112e1df

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/403718/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.4400.13644.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Launching the default Windows debugger (dwwin.exe)

Sending a TCP request to an infection source

Stealing user critical data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/649d439f10925f175aff9e76/reports/a6117ef0-1bf1-4530-90d5-1b09aa7745b9/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious Packer

Malware family:

Malicious Packer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2116ef50-f391-4397-a4b2-cc295d8fe3c8

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1263143

Signature

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4/

ReversingLabs TitaniumCloud Win32.Trojan.Privateloader

Threat name:

Win32.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-29 08:41:05 UTC

File Type:

PE (Exe)

Extracted files:

57

AV detection:

22 of 24 (91.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=26dw3ixt5yjojlrsbzr3dhvgqowc6lyutlov35cnvkdw2omi4hca._file

Threatray malicious

Verdict:

malicious

Similar samples:

00fc3bba8814fea6dd4c9b78ae51876f5e6a213ca7919451253008330160aba2

RedLineStealer

17b06b8cdf3b99754409988f579971fa396ad1807570143818ef5c0c532dd86d

RedLineStealer

36613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6

RedLineStealer

38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc

RedLineStealer

62a2221333631de6cf65db3fa3e2650947b23f24ea172a3ea998d77baa0cb270

RedLineStealer

e54412bc24512c26b03a502256ba54730489e38d5a18adaf594dd8f5efc9665d

RedLineStealer

ebb2ba69aefa29443238a76949a991384b01e4bb8291cfc5531e233d448cb280

RedLineStealer

+ 92 additional samples on MalwareBazaar

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline botnet:logsdiller cloud (telegram: @logsdillabot) discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230629-klez1sce33/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

146.59.161.7:36019

UnpacMe redline

Unpacked files

SH256 hash:

bb36d6fa8e269b435acc19e969d5c44a7c7458d44c16d4fdd9044b141823ccee

MD5 hash:

047f072aba968dbc6c9d574c5c79df5c

SHA1 hash:

ffe291294a49d21a039bb773aa977f863a8d2ca8

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

10f3dfb63a4cd9e16f99d8622ec3898622cf112c60240ddb311c01f1edb5d452

MD5 hash:

d27e9b2c24c2fbce0fe39189d037149e

SHA1 hash:

c46ce7742fe8f87f620583db8b1663bd5b00675d

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

8e18d2f750cb63967a92ad938976f36d1698f0e094c1a89bb23b858093af3086

MD5 hash:

63b253e89de90959f3800517ab0fe492

SHA1 hash:

9c324abf930f5cbbedd81547177bfbc50ed678b8

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

SH256 hash:

bb36d6fa8e269b435acc19e969d5c44a7c7458d44c16d4fdd9044b141823ccee

MD5 hash:

047f072aba968dbc6c9d574c5c79df5c

SHA1 hash:

ffe291294a49d21a039bb773aa977f863a8d2ca8

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

10f3dfb63a4cd9e16f99d8622ec3898622cf112c60240ddb311c01f1edb5d452

MD5 hash:

d27e9b2c24c2fbce0fe39189d037149e

SHA1 hash:

c46ce7742fe8f87f620583db8b1663bd5b00675d

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

8e18d2f750cb63967a92ad938976f36d1698f0e094c1a89bb23b858093af3086

MD5 hash:

63b253e89de90959f3800517ab0fe492

SHA1 hash:

9c324abf930f5cbbedd81547177bfbc50ed678b8

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

SH256 hash:

bb36d6fa8e269b435acc19e969d5c44a7c7458d44c16d4fdd9044b141823ccee

MD5 hash:

047f072aba968dbc6c9d574c5c79df5c

SHA1 hash:

ffe291294a49d21a039bb773aa977f863a8d2ca8

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

10f3dfb63a4cd9e16f99d8622ec3898622cf112c60240ddb311c01f1edb5d452

MD5 hash:

d27e9b2c24c2fbce0fe39189d037149e

SHA1 hash:

c46ce7742fe8f87f620583db8b1663bd5b00675d

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

8e18d2f750cb63967a92ad938976f36d1698f0e094c1a89bb23b858093af3086

MD5 hash:

63b253e89de90959f3800517ab0fe492

SHA1 hash:

9c324abf930f5cbbedd81547177bfbc50ed678b8

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

SH256 hash:

d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4

MD5 hash:

c86be0608ca0a4b00158a845db672d6c

SHA1 hash:

ffe713b1baa73ca65e7c2a9b88b471f715308526

Link:

https://www.unpac.me/results/62cf86b7-e9d5-4381-bbd2-0af93df87d8a/

VMRay RedNet

Malware family:

RedNet

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d7876da2f3ee/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2667674/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/403718/