MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef820b648b3feeef54dc625e9aa405335acbe29f33314df89b535579a7b08a82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments 1

SHA256 hash:	ef820b648b3feeef54dc625e9aa405335acbe29f33314df89b535579a7b08a82
SHA3-384 hash:	Calculating hash
SHA1 hash:	Calculating hash
MD5 hash:	ac0a0d64408f40e1c3b0ca8ee8b1e13a
humanhash:	Calculating hash
File name:	ac0a0d64408f40e1c3b0ca8ee8b1e13a
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	313'344 bytes
First seen:	2021-12-16 23:35:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	Calculating imphash
ssdeep	Calculating ssdeep hash
TLSH	Calculating TLSH
telfhash	Calculating telfhash
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/214694/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen3.8550.30101.14620.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2324/overview

Behaviour

MalwareBazaar

CPUID_Instruction

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61bbcd546daa353fa3b6662f/reports/bfb08dbf-2538-4419-a392-7eefd81e9dea/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8cc71e4d-ea23-4cc2-9240-eaac802d7173

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/908841

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=56bawzelh7xo6vg4mjpjvjafgnnmxyu7gmyu36e3knkxtj5qrkba._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:zoom discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211216-3ldfasdab6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

178.238.8.47:34210

Unpacked files

SH256 hash:

42d5d954004c787bcc7c263b5425ca46f4374085b0a3c482f086c12d2a7b205f

MD5 hash:

2e1c7f39a553c00c4fae5ea2abc69913

SHA1 hash:

f69d72b53d5a55220bae89566128dea850d23afe

Link:

https://www.unpac.me/results/306dbc04-a707-4e32-b897-43ac6d14669f/

SH256 hash:

dd302ca95b03534389f0f32450d43f36b6154f6755f8a4f49a3288bb6d0e3a13

MD5 hash:

9dadfc85dad5abea0234ffd9226efbeb

SHA1 hash:

b6f58b9b9b0472758861f69e80ee51fc7775c191

Link:

https://www.unpac.me/results/306dbc04-a707-4e32-b897-43ac6d14669f/

SH256 hash:

16edbaadd4d4af1807baff0aee0b12950a9cd1759cf6b4646ff8a7052b86e3e8

MD5 hash:

f7c24465f4503c4890750db896834d74

SHA1 hash:

72671494c482966cbef2f6f6ff663f7a75c46512

Link:

https://www.unpac.me/results/306dbc04-a707-4e32-b897-43ac6d14669f/

SH256 hash:

ef820b648b3feeef54dc625e9aa405335acbe29f33314df89b535579a7b08a82

MD5 hash:

ac0a0d64408f40e1c3b0ca8ee8b1e13a

SHA1 hash:

8dfbb87a4aeb3fbbbb0cf7413325c1e8e74ba63d

Link:

https://www.unpac.me/results/306dbc04-a707-4e32-b897-43ac6d14669f/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.