MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e68a623d7c06f7ecdc50508058dbb28bba9806fd507413168090d454ebfb366d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	e68a623d7c06f7ecdc50508058dbb28bba9806fd507413168090d454ebfb366d
SHA3-384 hash:	7903a461320a96ff7c9c923ae8b65a4efb87e6e0821f920324001f81c45991bf9455f4addd88972f67f9ab45f35e8952
SHA1 hash:	04f4c13c56e4e79ed2391fd0efe3f92d1f135569
MD5 hash:	eb9657bc8d08db9b2e9e282e59034ab1
humanhash:	gee-undress-wisconsin-tennessee
File name:	eb9657bc8d08db9b2e9e282e59034ab1.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	408'064 bytes
First seen:	2021-11-03 20:08:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7e51d9833813c1a3fb57baba54855909 (2 x RedLineStealer, 1 x Loki, 1 x IcedID)
ssdeep	6144:EWkaOLIGPMDT3LNgfjWW6tPbHh/B4iWJBJeFaI5EDzlZkoT0ekW:E9p7kDT9tHh/aiWJveFaI5EVZkowe
TLSH	T1C794BF10E6A1C035F5B252F84AB693A9B93F7EA1A73451CF22D416EE5734AE1EC31307
File icon (PE):
dhash icon	b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

136

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

eb9657bc8d08db9b2e9e282e59034ab1.exe

Verdict:

Malicious activity

Analysis date:

2021-11-03 21:03:36 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/3a5c871e-82cd-40d2-b173-42d119f950ac

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/202043/

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6182ec64bf51178dbe4d8893/reports/51b00c93-7a3b-4f66-bc59-0537b7301618/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/94d4fe72-70dd-46ef-ac78-849088dabde5

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/882647

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e68a623d7c06f7ecdc50508058dbb28bba9806fd507413168090d454ebfb366d/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2021-11-03 20:09:09 UTC

AV detection:

23 of 44 (52.27%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=42fgepl4a336zxcqkcafrw5sro5jqbx5kb2bgfuasdkfj273gzwq._file

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:updbdate discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211103-yw5kbaehb9/

Behaviour

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

193.56.146.64:65441

Unpacked files

SH256 hash:

bf89bbeb9c8c26b97cabafc37f82a7a8c17beaa9c4c2022a0fa97e192c2e5341

MD5 hash:

4f7919e72580d05f83c2efdf5be272bf

SHA1 hash:

a32da4d24a60c85651f492ddec81c50a947bc7f7

Link:

https://www.unpac.me/results/b1b2f473-7d10-466a-8dfa-efa61ae8eaa4/

SH256 hash:

d5acec00fe9f8896cd6965ac70d8576a76b418f28d1edc6d12b802a6c4b65efa

MD5 hash:

2691eb4069f4e0da4cfa1c39758009ec

SHA1 hash:

9a4684a2b771e1fcbe0572d15a21bf320a450ebf

Link:

https://www.unpac.me/results/b1b2f473-7d10-466a-8dfa-efa61ae8eaa4/

SH256 hash:

05c03b24ee6a0fdc40fbe8a6db1f9501404c87376ca8876fd304be4c16ac0b74

MD5 hash:

e70dcfa399c1dfdb8f243d00eea36284

SHA1 hash:

09437d7f193419585d3af8a33ec09eb1c3e9c818

Link:

https://www.unpac.me/results/b1b2f473-7d10-466a-8dfa-efa61ae8eaa4/

SH256 hash:

e68a623d7c06f7ecdc50508058dbb28bba9806fd507413168090d454ebfb366d

MD5 hash:

eb9657bc8d08db9b2e9e282e59034ab1

SHA1 hash:

04f4c13c56e4e79ed2391fd0efe3f92d1f135569

Link:

https://www.unpac.me/results/b1b2f473-7d10-466a-8dfa-efa61ae8eaa4/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/e68a623d7c06/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e68a623d7c06f7ecdc50508058dbb28bba9806fd507413168090d454ebfb366d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.