MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eed60b9749e55ab52634fcc2befd94a17eca1e4b31af3eefd5593c0f1ce7083f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments 1

SHA256 hash:	eed60b9749e55ab52634fcc2befd94a17eca1e4b31af3eefd5593c0f1ce7083f
SHA3-384 hash:	615eb497c50e128b8027af35bcc38ba6801d540acaa23602e0b9127b1f0305f0e1ecf5db7bbd1d6483e119a1cc9a22d6
SHA1 hash:	4ae37dc2ea2ad48401c649269a48eae14be81bc9
MD5 hash:	f9d7a16586c6726808ac24b180bc0a5d
humanhash:	uniform-harry-pennsylvania-kitten
File name:	f9d7a16586c6726808ac24b180bc0a5d
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	320'512 bytes
First seen:	2021-09-20 09:54:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	90edc546938f77c6811e626812a78363 (3 x RedLineStealer, 1 x ArkeiStealer)
ssdeep	6144:yBZQ7yTsEY6m3Y1aqXNT7VV7jtMvzTGvx0qp9VRCOtqSyUci:EZDY6m3Y1nT7LfOATTVC/i
Threatray	6'287 similar samples on MalwareBazaar
TLSH	T13064BF20A7E0C035F4F711F859B693B8A43D7A715B3455CB52DA26FA23386E4AC30797
File icon (PE):
dhash icon	ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

61472b_Grammarly-1578-.zip

Verdict:

Malicious activity

Analysis date:

2021-09-19 12:29:27 UTC

Tags:

trojan evasion rat redline stealer vidar loader opendir

Link:

https://app.any.run/tasks/ebcb597a-a100-4125-9c93-2c9990635610

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/189378/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/955e16c0-1c2c-4197-b1bc-e96cc265af67

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/853912

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eed60b9749e55ab52634fcc2befd94a17eca1e4b31af3eefd5593c0f1ce7083f/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-09-18 15:42:53 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=53laxf2j4vnlkjru7tbl57muuf7muhslggxt536vle6a6hhhba7q._file

Verdict:

malicious

RedLineStealer

4812efb0999ba68eaec97f7318e4d23bfbe3c46c11084dbf989a3623cb7285be

RedLineStealer

5f340f1335f9e6a3d4e5c51eb3097e3bdf4d93645b925f537a45477427b87494

RedLineStealer

7b603dd82cb87eca59e93b2cd9c0eb8e613339097b23ac07daa9220a2eb4a7b4

RedLineStealer

9c46b0c1c7a38127b1b163163646703a91267c09537c38762ffa9586aa4a4d0a

RedLineStealer

bb1b86b5cffd8187f485c10aded4ffa0f9a1b53d83fc26d513a7cfb48c7dcecd

RedLineStealer

c25818485a3fe4e6728db023c55168a494810364ffa1421995a1e13309a61c2a

RedLineStealer

d4a432f1248930343a999a11dbcf5c7790f7c0d4856200aba7d20f956455fa2e

RedLineStealer

e206cdfadd769d8506f7dde22b1a3277075506810b455f491ff08fd42707a0a0

RedLineStealer

fb6bc2d81a684ce79e18aac92629f12193f6ebb69652c8d5119daf13f73d3cd5

RedLineStealer

+ 6'277 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:supertraff infostealer

Link:

https://tria.ge/reports/210920-lw79zsdeh7/

Behaviour

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.14.49.169:22411

Unpacked files

SH256 hash:

56bf374721f4cdaa19974cebeaf9bd560ca428a338e3966ecd0e352892669859

MD5 hash:

f0f26afc4dac7e2efff38a5b8dcc7651

SHA1 hash:

476cefa7129fe7711e82e09a4c986e42ac6881ac

Link:

https://www.unpac.me/results/201cd475-8f5e-4b3b-98d5-a7ec8e127360/

SH256 hash:

e5e7aaa1caf1fa571af7883469cfacf37a0c2b5d4f236abaadfa75a7d7a79084

MD5 hash:

1ef207c97b6c059edce683e3a05dc60f

SHA1 hash:

3d3e17417fca820b9f39adf710f54a4c41c70d78

Link:

https://www.unpac.me/results/201cd475-8f5e-4b3b-98d5-a7ec8e127360/

SH256 hash:

6b42cba73e514765b33e31c1435e3fa333de21926bfe19d644a0082051a5472e

MD5 hash:

5acc99346ea1de8100acfd17ada57d64

SHA1 hash:

02189090b7c3857823bf9b586261955bbbca4347

Link:

https://www.unpac.me/results/201cd475-8f5e-4b3b-98d5-a7ec8e127360/

SH256 hash:

eed60b9749e55ab52634fcc2befd94a17eca1e4b31af3eefd5593c0f1ce7083f

MD5 hash:

f9d7a16586c6726808ac24b180bc0a5d

SHA1 hash:

4ae37dc2ea2ad48401c649269a48eae14be81bc9

Link:

https://www.unpac.me/results/201cd475-8f5e-4b3b-98d5-a7ec8e127360/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eed60b9749e55ab52634fcc2befd94a17eca1e4b31af3eefd5593c0f1ce7083f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.