MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f07c88a523790b6109b9bdb9531b7d9f7c0c314f8b8c712b85ab81609da9c2e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 12
| SHA256 hash: | f07c88a523790b6109b9bdb9531b7d9f7c0c314f8b8c712b85ab81609da9c2e8 |
|---|---|
| SHA3-384 hash: | b19d5f9aa19bb0ce000cc704db8d617b3c4feefc121f31e2bc746582c6f52b486f82f89edf12e3bb6117233a620a2080 |
| SHA1 hash: | cfc12e06309c0bd22c536bf56e7d21ed040eea90 |
| MD5 hash: | e630aa3ed8a699e7bf41ad58988baa99 |
| humanhash: | monkey-california-georgia-speaker |
| File name: | f07c88a523790b6109b9bdb9531b7d9f7c0c314f8b8c7.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 238'080 bytes |
| First seen: | 2021-09-28 05:32:36 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f98cc9327e2d65cc6189a693f26e1c1d (5 x ArkeiStealer, 4 x RaccoonStealer, 3 x RedLineStealer) |
| ssdeep | 3072:iZnhJyiY/EU72MPoOLtxvkQufcM7Yr0lD8ONRSbWUZuqfP3+xEu5z:iRTRU6gtLXvAPYr097gqqfM9t |
| Threatray | 6'300 similar samples on MalwareBazaar |
| TLSH | T12834F13138A0F472DB4389F54915D2D2127EBA322BA1967B339C5BBF0E712D0D63A356 |
| File icon (PE): |  |
| dhash icon | b0a2b0a4f4f0ecb0 (1 x RedLineStealer) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 185.173.39.234:36881 | https://threatfox.abuse.ch/ioc/227271/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
zukuluti.pdf
Verdict:
Malicious activity
Analysis date:
2021-09-28 00:16:50 UTC
Tags:
evasion trojan opendir loader rat redline stealer vidar autoit 1xxbot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Connection attempt
Sending a custom TCP request
Launching a service
Creating a window
DNS request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Signature
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Racealer
Status:
Malicious
First seen:
2021-09-27 20:59:50 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 6'290 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:#proliv3 discovery infostealer spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.173.39.234:36881
Unpacked files
SH256 hash:
dca602f7fdead058f8eb9ef803e517c3924f1bf108ca7fb05c4c78f5ecd4dd8a
MD5 hash:
1bdb69ca513dad6e3ad10ab19895cccd
SHA1 hash:
e99e6318de85a3187d7c6130b2ebc37c493a0940
SH256 hash:
90e1f3a9073a8f47da1dd7ac25ceaec6e5a4f73f2b021a2d51314ba29cb44da7
MD5 hash:
8aca8f86c2d5fad69e3bbd0c5a5563de
SHA1 hash:
809acc93725c75af2b1083583928b0a1349b42da
SH256 hash:
3c56e7f0ab108f2c881fbb1d4a65b310e3f4ba2c32896bce1a1135b86fb161b7
MD5 hash:
e244658a2e5708859947db5af8069913
SHA1 hash:
6264c847578bc740377f999ebfbdf1157eac38aa
SH256 hash:
f07c88a523790b6109b9bdb9531b7d9f7c0c314f8b8c712b85ab81609da9c2e8
MD5 hash:
e630aa3ed8a699e7bf41ad58988baa99
SHA1 hash:
cfc12e06309c0bd22c536bf56e7d21ed040eea90
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.