MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c
SHA3-384 hash: a088c5f431a8ccdc677386b8b4d053ec28d6a4a5f8ffaef79088b40f5f8cd475b3df26da26afbe591c81fd3db8757ec4
SHA1 hash: 0acb451bae2bd0be3894d5b445484e8ea296606f
MD5 hash: 0d33b8311fd15b120060af3193cb6fab
humanhash: helium-grey-triple-undress
File name:0d33b8311fd15b120060af3193cb6fab.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:364'544 bytes
First seen:2022-12-30 08:30:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18f1ce522b0f7e717ce8c81fcf5d6257 (4 x RedLineStealer)
ssdeep 6144:IcSONi55EQmRZ17y4b7AOTjO4+HuEiDuAYs1Jl:uONi55EQ0J7l+AB1J
Threatray 1'964 similar samples on MalwareBazaar
TLSH T15E74910165C1B8A1FCEE1537C7ACBA6D5939B4610FC63AAB239FCBDD0E2318166E0457
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.42.244.249:5514

Intelligence

File Origin
# of uploads :
1
# of downloads :
173
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
0d33b8311fd15b120060af3193cb6fab.exe
Verdict:
Malicious activity
Analysis date:
2022-12-30 08:32:32 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/d3de6b29-7565-404d-9066-7a548842074e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Trojan.Trojanx-9981435-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware mikey ransomware smokeloader
Link:
https://www.filescan.io/uploads/63aea1c7a70bef46551c33ba/reports/7a43cd0b-5f48-4d67-b6ee-41c87fa52912/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/69fc7f99-4b1c-4f3a-ae16-a0d2389609e5
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1143128
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-12-30 08:31:07 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tymchv7lzgtgieeod5ja26qkkxnho5vhcnwwwryfmz3rkjm64ga._file
Verdict:
malicious
Similar samples:
018a65e059d418802b351b4611fe09093e5b50562143ce5a522c28ef0f0bcf10
RedLineStealer
2ac9675aa85fdc4ae911e08d08e3bf773dae1edd9a1beb0a0450bccaa2e6441d
RedLineStealer
501f2463bdfc1e0260205d87eab7bcfe23254cefb6f43923172bb852cc96b2dd
RedLineStealer
61a1cd94691b0e620eeb4ff4d424f48d07419b4de4ee27cfcadf2ee759b32004
RedLineStealer
639d797ca8e9aa8de8544cdf900682191797d640c76ea3880609fb3ec7fc3c43
RedLineStealer
6a38b624b2c17709d11ed370e10c9a4cb914bfd2deb331d18403a3e89917bb34
RedLineStealer
6ea1d03968fc6cc0faa8d80a7cff8451d260a6e89a8e6ab4e068c37acac0ed9b
RedLineStealer
9327393673ff9ae5509ec33ebe7f750d139d2b4e5faf05ea95a372be2331282e
RedLineStealer
9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b
RedLineStealer
b3631f77ec6c54f3bbbb2b2b59a647e3bcc3b330516c0b6de96113be9369ca46
RedLineStealer
+ 1'954 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:redline bot infostealer spyware
Link:
https://tria.ge/reports/221230-keqg6sae7s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
RedLine
Malware Config
C2 Extraction:
193.42.244.249:5514
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/33ab0fc3-5b4b-4710-9259-48de0ce9cb2c
Unpacked files
SH256 hash:
54f1a603ca015d94b530ecad2f88a50b0dbea189942d6443aa1d598bc995b008
MD5 hash:
8f23d1195d615cdfaab2b1007db71f6b
SHA1 hash:
84b5939c32bb494be7b58f34241a0441cf98d3b8
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/83169bb3-836d-4cdb-9e56-cae641459883/
Parent samples :
61a1cd94691b0e620eeb4ff4d424f48d07419b4de4ee27cfcadf2ee759b32004
9c64bca70fe75187dcac8bc03ef05667def8947f114a82bccf8b3928c36a067b
501f2463bdfc1e0260205d87eab7bcfe23254cefb6f43923172bb852cc96b2dd
ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c
99b21510e79967ae3ad4e40e757263ae61d5b8e5d3cecc76cfcfbff7b4848b10
691bfda349d0e18174260f9104159c4828b3ec20a53db6db96e8bd4560ffaa84
SH256 hash:
ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c
MD5 hash:
0d33b8311fd15b120060af3193cb6fab
SHA1 hash:
0acb451bae2bd0be3894d5b445484e8ea296606f
Link:
https://www.unpac.me/results/83169bb3-836d-4cdb-9e56-cae641459883/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ecf0c11ebf5e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Win32_Trojan_RedLineStealer
Create hunting rule
Author:Netskope Threat Labs
Description:Identifies RedLine Stealer samples
Reference:deb95cae4ba26dfba536402318154405

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ecf0c11ebf5e4d33208470fa906bd052aed3bbb5389b6b5a382b33b8a92cf70c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2487101/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2490122/
  
URLhaus
https://urlhaus.abuse.ch/url/2485916/

Comments