MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea53e534c97385c9b4c322177ffabe344c24e39ddfb02579dfaf88d81a45706c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 8 File information Comments 1

SHA256 hash:	ea53e534c97385c9b4c322177ffabe344c24e39ddfb02579dfaf88d81a45706c
SHA3-384 hash:	cc74a740aea656526d857c456697ce4346985a0abd825f91943ab0f7541f92cb66e54a84c07b6eb353ca0bf57e4e2717
SHA1 hash:	753f83efc184e089f4d8a65f0940ee13e276d7dd
MD5 hash:	95b1e2e49e2bdc20ee258323e54090cf
humanhash:	north-fourteen-charlie-india
File name:	95b1e2e49e2bdc20ee258323e54090cf
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	97'792 bytes
First seen:	2021-12-16 03:52:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2AteulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdIY
TLSH	T18EA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

n/a

Vendor Threat Intelligence

Detection:

IcedID

Link:

https://www.capesandbox.com/analysis/214429/

Detection(s):

Win.Malware.Bulz-9880537-0

Win.Packed.Bulz-9883367-0

Win.Packed.Generickdz-9885340-0

Win.Packed.Bulz-9891195-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Сreating synchronization primitives

Sending an HTTP POST request

Sending a custom TCP request

Creating a file in the %temp% directory

Reading critical registry keys

Using the Windows Management Instrumentation requests

Creating a window

Creating a file

Searching for the window

Stealing user critical data

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm fingerprint hacktool obfuscated packed stealer

Link:

https://www.filescan.io/uploads/61bab820dbe06b75d7bf8828/reports/2a4e163b-c7df-4927-9c3a-cf2413e70883/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7dd4afb9-a018-4b04-b41b-dd611ee04484

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/908248

Signature

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Found malware configuration

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ea53e534c97385c9b4c322177ffabe344c24e39ddfb02579dfaf88d81a45706c/

Threat name:

ByteCode-MSIL.Infostealer.RedLine

Status:

Malicious

First seen:

2021-12-12 02:46:52 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

32 of 45 (71.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5jj6kngjooc4tngdeilx76v6grgcjy4536yck6o7v6enqgsfobwa._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:build discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211216-efmj1sbhem/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

Malware Config

C2 Extraction:

80.85.139.143:40827

Unpacked files

SH256 hash:

ea53e534c97385c9b4c322177ffabe344c24e39ddfb02579dfaf88d81a45706c

MD5 hash:

95b1e2e49e2bdc20ee258323e54090cf

SHA1 hash:

753f83efc184e089f4d8a65f0940ee13e276d7dd

Link:

https://www.unpac.me/results/83482e45-cd61-45ff-b311-3ed60fb02c60/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.77

Link:

https://yomi.yoroi.company/submissions/ea53e534c97385c9b4c322177ffabe344c24e39ddfb02579dfaf88d81a45706c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	RedLine_a Create hunting rule
Author:	@bartblaze
Description:	Identifies RedLine stealer.

Rule name:	redline_new_bin Create hunting rule
Author:	James_inthe_box
Description:	Redline stealer
Reference:	https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8

Rule name:	redline_stealer Create hunting rule
Author:	jeFF0Falltrades
Description:	This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)