MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
SHA3-384 hash:	6f74b2bbcfe1076eba47f39e0099e4d1bfa4d18bef10357b6bd2087979f031bf259403dc604f1002bf9de3c2260df209
SHA1 hash:	814193713ef7b93b57e7141d86c7aa38a8999c76
MD5 hash:	041cc88cbceb864768d4d0ede0c0f88a
humanhash:	washington-magnesium-low-florida
File name:	041cc88cbceb864768d4d0ede0c0f88a.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	412'160 bytes
First seen:	2023-06-29 10:10:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	dc6e265d7c90a021ccdd169409ae96c6 (1 x Fabookie, 1 x RedLineStealer)
ssdeep	6144:uDRIz77bNZ2LTDYhDNKUa8r5iZ5EPXx3Y+yUDYeG:uDRy7bNZoYhhKaiZ5YXx31Y
Threatray	105 similar samples on MalwareBazaar
TLSH	T10A946DC3A2A07D5CF5254E729E1EC2E4BA0FF9504F4977AA92189B1F05F11A2C2FF650
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0525110101250513 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
146.59.161.7:36019

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

330

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN redline

Malware family:

redline

Alert

Create hunting rule

ID:

1

File name:

041cc88cbceb864768d4d0ede0c0f88a.exe

Verdict:

Malicious activity

Analysis date:

2023-06-29 10:11:48 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/012a4133-6baa-4a3c-9de4-13d139438dac

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/403725/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.21897.13919.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Creating a window

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Sending a TCP request to an infection source

Stealing user critical data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/649d58b792fd95d811254485/reports/cf8b2955-9717-4bfe-826b-8d53caf8ffbf/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious Packer

Malware family:

Malicious Packer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6bb596f0-f02c-4874-9421-bad9d18965d9

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1263170

Signature

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e/

ReversingLabs TitaniumCloud Win32.Trojan.Privateloader

Threat name:

Win32.Trojan.Privateloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-29 10:11:06 UTC

File Type:

PE (Exe)

Extracted files:

57

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ioasgk3ueloh5b7cy74qezmsv6wvoqqfx4w66bcvskvrxlne6pa._file

Threatray malicious

Verdict:

malicious

Similar samples:

00fc3bba8814fea6dd4c9b78ae51876f5e6a213ca7919451253008330160aba2

RedLineStealer

0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5

RedLineStealer

17b06b8cdf3b99754409988f579971fa396ad1807570143818ef5c0c532dd86d

RedLineStealer

36613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6

RedLineStealer

38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc

RedLineStealer

d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4

RedLineStealer

e54412bc24512c26b03a502256ba54730489e38d5a18adaf594dd8f5efc9665d

RedLineStealer

+ 95 additional samples on MalwareBazaar

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline botnet:logsdiller cloud (telegram: @logsdillabot) discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230629-l7xydsde7v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

146.59.161.7:36019

UnpacMe redline

Unpacked files

SH256 hash:

bb36d6fa8e269b435acc19e969d5c44a7c7458d44c16d4fdd9044b141823ccee

MD5 hash:

047f072aba968dbc6c9d574c5c79df5c

SHA1 hash:

ffe291294a49d21a039bb773aa977f863a8d2ca8

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

10f3dfb63a4cd9e16f99d8622ec3898622cf112c60240ddb311c01f1edb5d452

MD5 hash:

d27e9b2c24c2fbce0fe39189d037149e

SHA1 hash:

c46ce7742fe8f87f620583db8b1663bd5b00675d

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

8e18d2f750cb63967a92ad938976f36d1698f0e094c1a89bb23b858093af3086

MD5 hash:

63b253e89de90959f3800517ab0fe492

SHA1 hash:

9c324abf930f5cbbedd81547177bfbc50ed678b8

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

SH256 hash:

bb36d6fa8e269b435acc19e969d5c44a7c7458d44c16d4fdd9044b141823ccee

MD5 hash:

047f072aba968dbc6c9d574c5c79df5c

SHA1 hash:

ffe291294a49d21a039bb773aa977f863a8d2ca8

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

10f3dfb63a4cd9e16f99d8622ec3898622cf112c60240ddb311c01f1edb5d452

MD5 hash:

d27e9b2c24c2fbce0fe39189d037149e

SHA1 hash:

c46ce7742fe8f87f620583db8b1663bd5b00675d

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

8e18d2f750cb63967a92ad938976f36d1698f0e094c1a89bb23b858093af3086

MD5 hash:

63b253e89de90959f3800517ab0fe492

SHA1 hash:

9c324abf930f5cbbedd81547177bfbc50ed678b8

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

SH256 hash:

bb36d6fa8e269b435acc19e969d5c44a7c7458d44c16d4fdd9044b141823ccee

MD5 hash:

047f072aba968dbc6c9d574c5c79df5c

SHA1 hash:

ffe291294a49d21a039bb773aa977f863a8d2ca8

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

10f3dfb63a4cd9e16f99d8622ec3898622cf112c60240ddb311c01f1edb5d452

MD5 hash:

d27e9b2c24c2fbce0fe39189d037149e

SHA1 hash:

c46ce7742fe8f87f620583db8b1663bd5b00675d

Detections:

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

redline

Alert

Create hunting rule

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

Parent samples :

e26497821fd2899474082b54aee3556fa67899e14ee9105b5c00f5577b011b2f
dc162f6994b714c3f26ce9f5a6490d7b395ffebfb01e1949720177c3af03d7ab
99409ef40a5a3f9f4f57646dd024b496b8ff9608582516401e07559a42643a26
a1e291743bd691cfe33f6cb7872dc9c7a505be4102cd4f80f396a272ac5b5b48
025b9b89b269cdb626dc7468ac3e9a38233fc897a63f13258b44b214845ca57f
8df031c064bedb03b526085b4fc92dc47eb2fc0665b3547a51d312a99d6c1d99
4f3029cc31b3be2414aaaf50fb8b5ad6c19b9d9a8d15e27ff0f6b8bbb7ce4ae4
6da475ac175e61bf1658bb90de341b2f9642dfcf911dbfd44885239483050e1a
38179b42eacc00e5924414079ea3945b76e19b5853f37e44c5844d13aad16edc
d7876da2f3ee12e4ae320e63b19ea683ac2f2f149add5df44daa876d3988e1c4
0fabc1fb936acd314e8df063a42125d271b958a29455fe817c81c40522e0efa5
f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e
7d5a1acd402b5d1e7cc72fe0d7b947d2bb1a3123dce15c9ce5c286f1efa10ca8
43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8
92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3

SH256 hash:

8e18d2f750cb63967a92ad938976f36d1698f0e094c1a89bb23b858093af3086

MD5 hash:

63b253e89de90959f3800517ab0fe492

SHA1 hash:

9c324abf930f5cbbedd81547177bfbc50ed678b8

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

SH256 hash:

f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e

MD5 hash:

041cc88cbceb864768d4d0ede0c0f88a

SHA1 hash:

814193713ef7b93b57e7141d86c7aa38a8999c76

Link:

https://www.unpac.me/results/248d4186-b8b8-4556-892a-1fb64c254644/

VMRay RedNet

Malware family:

RedNet

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f21c09195ba1/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe f21c09195ba116e3f43f163fc8132c957d6aba102df96f7822ac9558dd6d279e

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2667674/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/403725/