MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec835c15a9000e86553ebd1ec3a1cabee067cde9683b526e5dd09a276e1cd50a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec835c15a9000e86553ebd1ec3a1cabee067cde9683b526e5dd09a276e1cd50a
SHA3-384 hash: f1f6cfd67ccddabda7d7afe6faf17de5e9d423f8c4148d02de958ce22d5a63f57bb1d0768b2ec642d0c4697a8ce4538b
SHA1 hash: c511b43a6caa02f4374c3219e024a3115465ae10
MD5 hash: 5a88beb2f18d3d5af56d184a9862b788
humanhash: april-thirteen-social-nitrogen
File name:5a88beb2f18d3d5af56d184a9862b788.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:398'848 bytes
First seen:2021-06-01 10:12:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 84a7eb4192b6bf7f0b88f528d598a47f (3 x RedLineStealer, 3 x Stop)
ssdeep 6144:2eJL82g8RUPrtYUn9i4SKlP8K8o1ViAFDprjvG8CiyfFPB/Lbb7CCiTa/j:2eJwgUDuUn9OKiKlEypjvaiyfFhT7q
Threatray 778 similar samples on MalwareBazaar
TLSH 4A849E10F690D034F1F336F48ABB92BDA529BDA1E72450CF62D46AEA56346E1EC31707
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
49.12.42.196:23783

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
49.12.42.196:23783 https://threatfox.abuse.ch/ioc/68303/

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5a88beb2f18d3d5af56d184a9862b788.exe
Verdict:
Malicious activity
Analysis date:
2021-06-01 10:16:29 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/0bf59210-bad7-434b-8720-a6cef34ec4c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/163770/
Detection(s):
Win.Malware.Generic-9867667-0
Create hunting rule

Win.Malware.Generic-9867727-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Connection attempt
Sending an HTTP POST request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/795196
Signature
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec835c15a9000e86553ebd1ec3a1cabee067cde9683b526e5dd09a276e1cd50a/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-06-01 10:13:08 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5sbvyfnjaahimvj6xupmhiokx3qgptpjna5ve3s52cnco3q42ufa._file
Verdict:
malicious
Similar samples:
1f090615b025ca978616652c41369f2331100c7650dabd92ee0fa650f29de47d
RedLineStealer
780aeaf7c9c4a6c1dbe53f2861c9ed2eb73790368dda106d1eee057fc8e33824
RedLineStealer
7ff8de714cd1be1409b0c13a946c21f945a0bfdc8fd7e0b1a0f4e20f3ba0e80a
RedLineStealer
8868ce65c7fb73b3b89c48f97e16249139f94e759ff44d955e493f0651ae5f3b
RedLineStealer
9c57d0fc5a49debe9dbb49bfebe011bcf249542f6bbd4eefd41c75c3b5ff7d51
RedLineStealer
a481ea6b643ad753a5538ec13c9f270e426e2a389c78ed9f48a0616f6a69ef4e
RedLineStealer
beef9882631d740d3cabb7ce14f299c1fc0e47e6cef65ff7e023ac4437d067f2
RedLineStealer
c5abf55b0591c96c64316cef1b7c5124f3b7ab3d05bc75ab80ae17c53d01dc72
RedLineStealer
d2e0e8c973c2e376d189271f581d1ffec730f8ca41dfc1e3d9ef0b675366ee9a
RedLineStealer
e87c87c4a26902bc8bbd9993162a98bfb67bb20f9b06cfc0084f5301bec9b816
RedLineStealer
+ 768 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:inerino discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210601-2fnqzslngs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
49.12.42.196:23783
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec835c15a9000e86553ebd1ec3a1cabee067cde9683b526e5dd09a276e1cd50a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ec835c15a9000e86553ebd1ec3a1cabee067cde9683b526e5dd09a276e1cd50a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1300624/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/163770/

Comments