MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f06c3d12ab2e2f5ee55d68e0503fc5a4c4e9ed190e1bf5db4fc3648de772ef09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f06c3d12ab2e2f5ee55d68e0503fc5a4c4e9ed190e1bf5db4fc3648de772ef09
SHA3-384 hash: f31baf4a58f87d81f26e77b411df4d640fe8c943f1b416305f035614f6d4d0f67db16a8220d0311288bbcb9774e6a253
SHA1 hash: b8115fc777d76c030f6ae5483abf30c44898f347
MD5 hash: 3d1de35934102f9e46c792a500af0c60
humanhash: five-emma-twelve-black
File name:3d1de35934102f9e46c792a500af0c60.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:360'960 bytes
First seen:2022-04-05 13:31:58 UTC
Last seen:2022-04-05 14:44:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a838cf9305c796ef9ede12c92e34f95f (6 x RedLineStealer, 2 x Loki, 2 x Stop)
ssdeep 6144:fDjqo5Ltc2+QeM2FSEiFvKyqC2sQV+X/zzah3FQkQV+A:fDjHxc2+QeNFSxinCzC+rAKV+
Threatray 2'296 similar samples on MalwareBazaar
TLSH T14B74CF10BBA0C035F1B716F459BA93A8B93E7DA05B2491CB62D516FE47346E4EC3131B
File icon (PE):PE icon
dhash icon 8ccc9caeaa8e4c8c (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.106.191.77:23196

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.106.191.77:23196 https://threatfox.abuse.ch/ioc/491660/

Intelligence

File Origin
# of uploads :
2
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/260960/
Detection(s):
SecuriteInfo.com.Variant.Mikey.136057.4375.16066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Stealing user critical data
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/12705/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware mikey packed
Link:
https://www.filescan.io/uploads/624c44ddaa7e43c6a6bc6d63/reports/be8d89c5-dedd-474e-a12a-2e8ec3ca2047/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/93ecceee-5a25-4704-b260-bd67b2eb6b94
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/970844
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f06c3d12ab2e2f5ee55d68e0503fc5a4c4e9ed190e1bf5db4fc3648de772ef09/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2022-04-05 13:32:08 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bwd2evlfyxv5zk5ndqfap6futcot3izbyn7lw2pynsi3z3s54eq._file
Verdict:
malicious
Similar samples:
0064777bacf702622aee29bd3c8c4b3caa61ce8254808111c604399747c48493
RedLineStealer
8aa3778b1e6ab75f87518f0e46b8721ca9146812107c2e94129a7c9c92df1669
RedLineStealer
a916c8ba779bd652e6ac26d4b4ab39a9372177e1413ffef5d646bd222bab5767
RedLineStealer
c97898192e6511ddc2edeb4eab7f043f3f0314de0085e932501abf9c70f9056f
RedLineStealer
d44e86e8dc010ea7a0046dd522c748cac970974c8577cfdf074d8deb9c908030
RedLineStealer
efa3bbe5308db5a1ba5694b5dc1eeb7c33fd80763ae37ba8f870ff336114b958
RedLineStealer
+ 2'286 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/220405-qsynlabebl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
3108cc34a78fa52d6173aa378ff8b599493604d75c88115982ca505e8319684f
MD5 hash:
e26500e0f39d38d5bb30ee25dcf4ea01
SHA1 hash:
f5fb37dd2f033fcd78151208e7b77a6ff38a8f33
Link:
https://www.unpac.me/results/2f666dc9-f2a6-4361-b95d-3d3cc9347a15/
SH256 hash:
4bbcf72a5bbe7c1f0a5dd37a471acb7be885b4c6a53283d9976eb00a6c5ced5b
MD5 hash:
fb302f2a09d2b977584de42b96209810
SHA1 hash:
c62af6cf16b72447823b2a086e7a277a1bd172e9
Link:
https://www.unpac.me/results/2f666dc9-f2a6-4361-b95d-3d3cc9347a15/
SH256 hash:
1362fd34ad0a6659f1a27ce24eff0f1d954460e24392c5239c8656fbea062bff
MD5 hash:
fc345fa1cf709882d3641b819992105d
SHA1 hash:
a788fe52fc7ed9f4a43e37ca89f665a9eb4760fa
Link:
https://www.unpac.me/results/2f666dc9-f2a6-4361-b95d-3d3cc9347a15/
SH256 hash:
f06c3d12ab2e2f5ee55d68e0503fc5a4c4e9ed190e1bf5db4fc3648de772ef09
MD5 hash:
3d1de35934102f9e46c792a500af0c60
SHA1 hash:
b8115fc777d76c030f6ae5483abf30c44898f347
Link:
https://www.unpac.me/results/2f666dc9-f2a6-4361-b95d-3d3cc9347a15/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f06c3d12ab2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f06c3d12ab2e2f5ee55d68e0503fc5a4c4e9ed190e1bf5db4fc3648de772ef09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe f06c3d12ab2e2f5ee55d68e0503fc5a4c4e9ed190e1bf5db4fc3648de772ef09

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2117062/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/260960/

Comments