MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs 1 YARA 6 File information Comments

SHA256 hash:	dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3
SHA3-384 hash:	ad126a8f002ed3750962b7cfd92f46ed5570683e58453563e32b8c5166bc02c1cab3259073a349be1ecc1f5a07fd50df
SHA1 hash:	c505429beddc51abc26c29e5ee96df5f44a8f171
MD5 hash:	d04d4d9896a08dc0ec357ca574814a1b
humanhash:	finch-music-finch-nineteen
File name:	d04d4d9896a08dc0ec357ca574814a1b.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	119'016 bytes
First seen:	2021-09-26 14:20:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	1536:Oe1lhb1fbF0/2kK32Zvvp3RjbuRGdYnhuyZ/dGVXdbknEXG6qTaoigNYT:T3tHEvvpFvYnYyZdGDkES9
Threatray	1'670 similar samples on MalwareBazaar
TLSH	T1A4C33A2553DCCB28FAFE1F757070121147F0E19B5512DB5B9DC2ACFA5E32B826A902E2
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
138.124.186.2:27999

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
138.124.186.2:27999	https://threatfox.abuse.ch/ioc/226741/

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d04d4d9896a08dc0ec357ca574814a1b.exe

Verdict:

Malicious activity

Analysis date:

2021-09-26 14:22:15 UTC

Tags:

trojan rat redline stealer

Link:

https://app.any.run/tasks/ab4a1fa5-5f8d-43ba-991a-fd392512f626

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/191771/

Detection(s):

Win.Packed.Bulz-9883367-0

Win.Packed.Generickdz-9885340-0

Win.Packed.Bulz-9888336-0

Win.Packed.Bulz-9891195-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

Launching a service

Creating a window

DNS request

Using the Windows Management Instrumentation requests

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8521ea09-9a88-42fb-89da-9db53f9bfcd2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/858423

Signature

Found malware configuration

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3/

Threat name:

ByteCode-MSIL.Trojan.RelineStealer

Status:

Malicious

First seen:

2021-09-26 12:10:34 UTC

AV detection:

28 of 45 (62.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3732kjitenoyb3se4cryyg4qpb4h2becv5tgi22kqtcdxrjz4kzq._file

Verdict:

malicious

RedLineStealer

1eb3574e7faa18d12759034dcc5a26ac90d79badef17cf1a744854d9a9e41cb0

RedLineStealer

52c8b2a76e11b6fab2913cde02aca252462f61a89e0436815e272fc74f0137ec

RedLineStealer

671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96

RedLineStealer

830b27683258b9f669a465aa971db78884f34dbe8d6fd261a4eae6e850b88c43

RedLineStealer

9b219f917b2990b8e0ab9a60f9d7b61c281dbef457b20c2b0a1e5e8b1989d74c

RedLineStealer

a4ffe5148767a4349cc43b105357623c0a47f64433a55d0aaed63f3a2a3e4493

RedLineStealer

b5b8be0cd8c49e313fb626534cc7d705ef7591184753faaddcd87e0f74a2cac1

RedLineStealer

d1653b5cbbf61f3666ac0c5ac308b75d0d0c5029941ca9efbf37f18b51f9a3a6

RedLineStealer

e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3

RedLineStealer

+ 1'660 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:installszxc discovery spyware stealer

Link:

https://tria.ge/reports/210926-rnzwjaehh6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Malware Config

C2 Extraction:

138.124.186.2:27999

Unpacked files

SH256 hash:

dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

MD5 hash:

d04d4d9896a08dc0ec357ca574814a1b

SHA1 hash:

c505429beddc51abc26c29e5ee96df5f44a8f171

Link:

https://www.unpac.me/results/cb13705a-08f7-4ac1-a97e-88cc17509680/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	redline_stealer Create hunting rule
Author:	jeFF0Falltrades
Description:	This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)