MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569
SHA3-384 hash: f0ad4e276f35e83513662e01a3f8325c4ffc8093a7915bb4643d08b05be7c6b46e6388be2eacda520c7efcd771cca382
SHA1 hash: 6ccfc977b5b25fa7964c70bc3061dbd85634c778
MD5 hash: 7d16e203ee63afab07d943c4aaf6b47b
humanhash: vegan-fanta-sierra-ceiling
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'401'760 bytes
First seen:2023-03-07 14:25:51 UTC
Last seen:2023-03-07 17:38:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 20db1e79c216f1d522f5cd084231f477 (4 x RedLineStealer)
ssdeep 6144:8b7zSTVhl5s/9AOYeGrl/SeVN0a2wScYF:y7zShc2FlDeci
Threatray 388 similar samples on MalwareBazaar
TLSH T169554BBD225C552FD71A52318CFB4991F82EE3B30A420ABE6F9C8A168713DE045F3D95
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc10773776_660595087?hash=PSbQLO11P9z9gIfRHmuhFwmnoKdohhEp7HYLm2I5zBD&dl=GEYDONZTG43TM:1678007028:e0gzzZlzHmSPZf4eHoDoul4h0nplUythPfFGMFh1Wsc&api=1&no_preview=1#and7

Intelligence

File Origin
# of uploads :
3
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-03-07 14:44:49 UTC
Tags:
redline
Link:
https://app.any.run/tasks/5f3b8e73-b995-4ddf-bc35-45eba06269f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/372347/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65800454.5723.24904.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm exploit greyware overlay packed raccoon redline
Link:
https://www.filescan.io/uploads/6407497c67ca02bce170b384/reports/785c315b-2497-40ae-9feb-df6ade8c880b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/042140ef-7fca-409a-8ad7-17a2b6252a8a
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1188763
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-05 17:22:00 UTC
File Type:
PE (Exe)
AV detection:
19 of 39 (48.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5juf3t4h2cotaaogdn3ac6zkxd5h3jvzw44ufeicfpvphdxgcvuq._file
Verdict:
malicious
Similar samples:
1331d10811b5b02f55f7a6fa0e957543c2c2ea5c9817518f97905b6038dfed93
RedLineStealer
48e5254ba169afae1d8738c988a7c00c34f12f452f28a7f19c4ed34ae0014d73
RedLineStealer
4dc43e28a0587cac34a92bf41308483f0b29f9a10f5bad041a72bd84386c2199
RedLineStealer
504915325cb3388bfe4d43d189241e4ebe6c647169bc49c199a7c74a764f3510
RedLineStealer
57faf10d8b88aa01b650deba123db2ab0823b541044fb8e6585a2bfc319f9a4f
RedLineStealer
5b448efa26739f46016d83c4d735822880e2ff5288d191c99c545666f04ba356
RedLineStealer
7b63a593d3daeb1dcbd92382a310cf88798ce82cd4d33c0d14b85ff30a85e20a
RedLineStealer
ca10c218c7ed12f56148c11d31a0698c8d232064faba12402c16b70f7e34bf55
RedLineStealer
fc11c7743ee5d510bb52732f41f0ba40be8da3be2d820cf91a0774d575f11434
RedLineStealer
fcb68c665d4639bacb89984706b5c2bbea6633e9c6f4d7639c468e553e45f47d
RedLineStealer
+ 378 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/230307-rrv2rahh2t/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
6f47813540596a0a61114b981daca2a18108fab9efe56b3c28cbe058a7bfed83
MD5 hash:
7f95f3b6121f356cbb56f8f1dc1f3635
SHA1 hash:
6adf746f5ac04a9fefbb34aaaa13fdbb829d1af5
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/3ea01c58-00f2-45a9-b2ca-9a9c4cfdd9b0/
SH256 hash:
ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569
MD5 hash:
7d16e203ee63afab07d943c4aaf6b47b
SHA1 hash:
6ccfc977b5b25fa7964c70bc3061dbd85634c778
Link:
https://www.unpac.me/results/3ea01c58-00f2-45a9-b2ca-9a9c4cfdd9b0/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ea685dcf87d0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.12
Link:
https://yomi.yoroi.company/submissions/ea685dcf87d09d3001c61b76017b2ab8fa7da6b9b7394291022beaf38ee61569

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/372347/

Comments