MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0
SHA3-384 hash: 1785c63bac251b01b6bfd4a0ea8b903fb3044b7d6a87583070f95be042dc0da7e9e100977a0523930f17c17101ce908e
SHA1 hash: 50334d8144ca8278f83ca279d22d142637acd341
MD5 hash: 1adb2662c75187ef4aad7be7f16a8f4d
humanhash: high-six-friend-earth
File name:1adb2662c75187ef4aad7be7f16a8f4d.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:370'176 bytes
First seen:2021-09-25 08:00:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 968069613992074265463fec272c56c9 (15 x RedLineStealer, 6 x RaccoonStealer, 2 x Tofsee)
ssdeep 6144:nIr2R1bj/slGbEK4714ynsu/Nep/t75JoKJdjWWEb8ri7y5U:nIr2Pj/sl9nxNItTJNwbboU
Threatray 6'370 similar samples on MalwareBazaar
TLSH T10974B020B7E0C039F5B713F559BA97B9AA3D79B06B2490CF52D216EA52746E0CD30387
File icon (PE):PE icon
dhash icon ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.9.20.20:13441

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.9.20.20:13441 https://threatfox.abuse.ch/ioc/226443/

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1adb2662c75187ef4aad7be7f16a8f4d.exe
Verdict:
Malicious activity
Analysis date:
2021-09-25 08:09:50 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/4e0b7ac4-6af2-44d0-afac-b0cdf093d437

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191351/
Detection(s):
Win.Packed.Generic-9896517-0
Create hunting rule

Win.Packed.Generic-9896518-0
Create hunting rule

Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/10004cad-2209-41da-9609-5cdc83c12165
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/857816
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-25 08:01:09 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yqbrh5ezcbpf3dd7lwuyb5svesloiyuanitpeoooypx3ako4laa._file
Verdict:
malicious
Similar samples:
09d58d081dd9364e99857ac273d52a17a0473cc64e64d0e15b2b9b2f67ef2d49
RedLineStealer
0bf6a1d5881e769e61a2f671e29dd45c0d3486f306b3d52f2976eb7223694256
RedLineStealer
267fad2a2432ab3e4214952aee8ce30058be5375c4b5d1f2fc48184e3f789885
RedLineStealer
3668ef74bccc72fe12cb1dfe661a5a3eccb4a4b07f2080db423f0b4f1cc3f10d
RedLineStealer
71f8415c24040b573b4852f93ba4df25f83f2a57c536ca9b19011b6ceb9c4528
RedLineStealer
744fb5f67ed2b1bed63d2334d16d938cdd3ce1d70a05bf829e3b06237377d3e5
RedLineStealer
8498f560c45b7d2db3427aaf5a481a4e584a1aa8f59767147e895b60e08286cf
RedLineStealer
ad0048e191fb0db386dfada7927fc139777d8a85858073fd014c0989794b9e73
RedLineStealer
c8b5d2344649034adbf12d74aaffcdc35ff13c2398acce155fc6e79d42f49dc7
RedLineStealer
ebfe4a01a842ddcf434e44a288773454c4c5c35602a5fba3a31e47ff010a1314
RedLineStealer
+ 6'360 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:udp discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210925-jwksksagd7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.9.20.20:13441
Unpacked files
SH256 hash:
90b0e7d902727351e4a88f3b02c2d3d15d202b2a0ea118c961c21c258617c1cf
MD5 hash:
6ac070b383c57c84bce059f1611a8bc0
SHA1 hash:
f8768f72c0cc63945cbe31b75e39a9d207db06b5
Link:
https://www.unpac.me/results/14e84e6c-6d77-4ec9-85c5-12821fe03e97/
SH256 hash:
74ec8e7f6661e87226bb95a4ba97ae828c45f3142b78d068492cff7162bbbd47
MD5 hash:
f007c18cee4cbdd6992122a8a216ccc0
SHA1 hash:
5b931b76947bb4484ae7b94a60e83c65f92b21b3
Link:
https://www.unpac.me/results/14e84e6c-6d77-4ec9-85c5-12821fe03e97/
SH256 hash:
fc667313899f6647f9d67a16af1234ac6b109223b7c3ce0d178614985cfd27e9
MD5 hash:
24eb234842defb045592109e300bed32
SHA1 hash:
4fa3017ddf932a7f7ae7fbbeda7eacbea609f283
Link:
https://www.unpac.me/results/14e84e6c-6d77-4ec9-85c5-12821fe03e97/
SH256 hash:
e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0
MD5 hash:
1adb2662c75187ef4aad7be7f16a8f4d
SHA1 hash:
50334d8144ca8278f83ca279d22d142637acd341
Link:
https://www.unpac.me/results/14e84e6c-6d77-4ec9-85c5-12821fe03e97/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e620189fa4c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe e620189fa4c882f2ec63faed4c07b2a924b7231403513791ce761f7d814ee2c0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1632262/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/191351/

Comments