MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 3 File information Comments 1

SHA256 hash:	d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619
SHA3-384 hash:	f1dac0815754b51a5b18b26d43a4861173072e8f2c9f0faf940076ccf4d39cb42720496aad8fc9d222dd4682ef705c48
SHA1 hash:	0e38a6251c6e7bc6e99be2bbf49a430b72255cdf
MD5 hash:	e30e255eeb7b86eb56c0693abaef7224
humanhash:	kansas-arkansas-wolfram-happy
File name:	e30e255eeb7b86eb56c0693abaef7224
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	404'480 bytes
First seen:	2023-02-03 08:45:29 UTC
Last seen:	2023-02-03 10:35:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ecf2cf91793bc455a24f8d379859c34a (17 x RedLineStealer, 11 x Smoke Loader, 4 x Amadey)
ssdeep	6144:YHnsoLYPPfY3dG+apJaQSQLgorfDSQDXSwKMXeAxw:YHsoUfYN8SQaQfrNAu
Threatray	15'513 similar samples on MalwareBazaar
TLSH	T16184012275C1D072C95B4630AC64DB662B7EF6315638A807BBE817BE4F702D1673B31A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	816a6e6a6a6a6a64 (15 x RedLineStealer, 8 x Smoke Loader, 6 x Amadey)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

e30e255eeb7b86eb56c0693abaef7224

Verdict:

Malicious activity

Analysis date:

2023-02-03 08:46:22 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/432fe84a-c896-4245-882c-5ee781d018c6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/359801/

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.7988.6086.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Searching for the window

Launching the default Windows debugger (dwwin.exe)

Sending a TCP request to an infection source

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/63dcc9cf2d4f6d560e241a25/reports/4e9a7b03-9c94-4971-aea9-58604dfac2d4/overview

Verdict:

Malicious

Labled as:

Ransom.51A80467

Link:

https://www.hybrid-analysis.com/sample/d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6563fb7a-21c2-4f7c-bc78-6e91be5091ff

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1164938

Signature

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2023-02-03 08:46:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3cszf4l5lshn5jcv5hletgugslt7vg45k7ubwrsddxtvj5kocymq._file

Verdict:

malicious

RedLineStealer

09cd10b5fa6e6fadbf9cb53fb2bed5ea2dffb8869a9e5eacaf859e0882283704

RedLineStealer

303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca

RedLineStealer

66967d49e5d96c09737095adf9f655361955d4b41854662ced6cc2414f780db6

RedLineStealer

7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5

RedLineStealer

ad823c3fe333416ad08d432f923dbeca80942f67a9c8d70c7155964519bbe7ad

RedLineStealer

+ 15'503 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:2-2-2023@ discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230203-kpavgagg3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

91.215.85.155:32796

Unpacked files

SH256 hash:

02d15cc70446bda384a483ed4d81e5fd4bf7a2c5848ea5ec355fa693dfff8503

MD5 hash:

b95cc5ff84e75ce7bbc38edf9f0746fa

SHA1 hash:

a3c4b7ea0200305a45cd6214ec63ec6948dfb6b8

Detections:

redline

Link:

https://www.unpac.me/results/f2070532-77b9-4420-9c55-9286836e6519/

Parent samples :

ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
b4fca86320683b5176268d1d5abeacb58e00524fc8313168d54e12060ac49e70
01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
518af0c342abeae63a11c907605380199a0b6f344a93713e05d1efeada57a3ff
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
4efb4f9512c3ab9f014214f54299326b535205a2280c838827eb4ab81e4b9a61
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619

SH256 hash:

5243496a6317fa28696043916abcda8a598d9e4b3d101a04d8eb33c8f998d227

MD5 hash:

fa49d962de59c209b6f269007a1dfb49

SHA1 hash:

322a177a0031221ebec3dc788166e4946363f830

Detections:

redline

Link:

https://www.unpac.me/results/f2070532-77b9-4420-9c55-9286836e6519/

Parent samples :

01c007dc096c0fc7019e919cc088655b0f2b494d96c1c4bf6f8601d49a66764d
af7bc7da8a078a53b9b0e620891e8f433a00ca03a86bae9c45ab91a103432493
d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
3938fe655fb2c6eed2ef526642501ab1476f7820b25ea312e3204224a28c0141
57a630b418e3160ed49c7a1ed7dda0f59b69c997b9f64d639382218be4679eab
d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619

SH256 hash:

a09bb30e4ac852eeb4fbfe3c4900606f83775936b6be3c175c4dc773376a273b

MD5 hash:

135d8693f5bddda089165c5d0461cf8e

SHA1 hash:

0b93c573787c2bbd9f6dc0a5aecacd95d271d3de

Link:

https://www.unpac.me/results/f2070532-77b9-4420-9c55-9286836e6519/

SH256 hash:

d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619

MD5 hash:

e30e255eeb7b86eb56c0693abaef7224

SHA1 hash:

0e38a6251c6e7bc6e99be2bbf49a430b72255cdf

Link:

https://www.unpac.me/results/f2070532-77b9-4420-9c55-9286836e6519/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d8a592f17d5c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe d8a592f17d5c8edea455e9d6499a8692e7fa9b9d57e81b46431de754f54e1619

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2498781/

Cape

https://www.capesandbox.com/analysis/359801/

URLhaus

https://urlhaus.abuse.ch/url/2403396/

URLhaus

https://urlhaus.abuse.ch/url/2440457/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-02-03 08:45:32 UTC

url : hxxp://paris.newemprirez.com/puta/softwinx86.exe