MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SHA3-384 hash: ed936631bce6f7040b62c1f30e1095f89dd2d63b0b3075cd856a0e3649581c45cc580bb22b805aa6e4da58e9ddd456ad
SHA1 hash: 34e784ff89414e20d7782f34a982a926f27384ac
MD5 hash: 9eeb516f7553fe64c0742866409e5e09
humanhash: ceiling-glucose-nevada-west
File name:9eeb516f7553fe64c0742866409e5e09.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:481'280 bytes
First seen:2022-11-02 07:15:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afc7d909da36af48cef76235ed3940db (2 x Amadey, 1 x RedLineStealer)
ssdeep 6144:6nyB+FovLbZeEVn6uQLDyEyiL9hByK+HbmtVVKSQYZL7ITsq/:6nDyvLbAEI5LEkzVybaVKSQQ7
TLSH T136A4F1E03591C072C05678358835CB90BA7FBD62D5A88A473BB836AF6F303D25A76357
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 9999b074e4e6c64a (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.24:47242

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
9eeb516f7553fe64c0742866409e5e09.exe
Verdict:
Malicious activity
Analysis date:
2022-11-02 07:16:53 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/412efb60-12a7-493c-9b95-3fe6fa406b38

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/327014/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.63323263.9246.596.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Connecting to a non-recommended domain
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult greyware lockbit
Link:
https://www.filescan.io/uploads/63621933a5db8d309cbc508c/reports/1b378608-497d-405d-a7fa-540bdc78f120/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fb9012ea-cb6d-4bc2-b048-577ca0dc6f7b
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1103021
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-02 01:57:01 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3z4wj53wwsuxwitaqnhbyjeino75oflqawmecsyjeevrpauylkta._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:dozkey discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221102-h3s7vsabd6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
193.106.191.24:47242
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9ced5341-d8dc-468a-9b43-afe077fad33f
Unpacked files
SH256 hash:
e5d6957ed2d1dd8c8d2e94297ac49c67dce7b1969ca0e7ed719f352083232a7b
MD5 hash:
67f69dcc34c67ff5297c5e7bdcdf82cc
SHA1 hash:
79d986e6837eb62c1113bef9a7d95294fb5e1bd9
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/4c2a3296-48e2-4a4f-a43e-4dc6d4972cce/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
294794b4e480bfaf0f96bff492d33c115a47d07c7b727618ca61f092d0f93096
MD5 hash:
2cb65c4dd615432dfcad784a2d3184c9
SHA1 hash:
5f7069d73db72c4786b5f88b7ebeb1b6adafd5a2
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/4c2a3296-48e2-4a4f-a43e-4dc6d4972cce/
Parent samples :
2a9e7edcfe62d33ff091826f8933573e807f8ab1795aa9bb97da4c1c79c01e37
ab53c1842d525b940656ef13277dcc83f1dc1d42cdc2f1172f786e9ae76421c5
ba01b7747f37910dde62e069a0ca47aec809f02739ade498d1a069422eeaa732
af669fa4f200fcc0c00d9aea49027d3d2ace15d6b055156195cf05ee6cd7906d
3ad195a9fb644c1640ac73f45bcce80e8a6c9e54fba7519040008fdb6425302c
6701fded83183ae22696ea1f7a9eca66ccae1b089e73803ffc44e34dc5efa33e
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
SH256 hash:
fd5e4d6282eb852549b996ab98aef3bc22c7f6e053a4fdc742b767daa801024b
MD5 hash:
8c982caea354e82103b3a9d4f4e60ae9
SHA1 hash:
4635f41b7a6fa18c4d09dc8416aa1a00c6dbdb10
Link:
https://www.unpac.me/results/4c2a3296-48e2-4a4f-a43e-4dc6d4972cce/
SH256 hash:
de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6
MD5 hash:
9eeb516f7553fe64c0742866409e5e09
SHA1 hash:
34e784ff89414e20d7782f34a982a926f27384ac
Link:
https://www.unpac.me/results/4c2a3296-48e2-4a4f-a43e-4dc6d4972cce/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de7964f776b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe de7964f776b4a97b2260834e1c24886bbfd715700598414b09212b1782985aa6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2384053/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/327014/

Comments