MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3d5ae4cb68b6a2b5ac818fbb3e7fe78bf49ce36e768f0f73d61f5870d2f7d52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	f3d5ae4cb68b6a2b5ac818fbb3e7fe78bf49ce36e768f0f73d61f5870d2f7d52
SHA3-384 hash:	64d90a3106397c11d64166921f8bd8c8d17d7840e4a92a6d9ce0a2e3634230aa3b201a54951c3d5c52cb405a253e7889
SHA1 hash:	bb2123f116bbb8b823245f74a7fe1f687f0c81e2
MD5 hash:	e9b100cdeac17271fa5fd4cf9a9de6f0
humanhash:	red-oklahoma-massachusetts-cat
File name:	e9b100cdeac17271fa5fd4cf9a9de6f0.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	408'064 bytes
First seen:	2021-07-28 18:06:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	800102d28cf35c665bee356e0e434ad6 (2 x Loki, 1 x CryptBot, 1 x RedLineStealer)
ssdeep	12288:KefrfNr3zb6gH/cH0HdyCwTqTSWiJMMs:HF3zb60hwTq1iJ6
Threatray	3'821 similar samples on MalwareBazaar
TLSH	T14094AE30EFA1C035E5F612F849B6937CA6293AB15F3050CB53D92AEE16346E1AC31677
dhash icon	5452b2e068696c46 (2 x DanaBot, 1 x Smoke Loader, 1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e9b100cdeac17271fa5fd4cf9a9de6f0.exe

Verdict:

Malicious activity

Analysis date:

2021-07-28 18:10:23 UTC

Tags:

installer trojan rat redline stealer

Link:

https://app.any.run/tasks/b1971c68-bd65-4ee5-a934-f45aa18e3965

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/174777/

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f5fc6ec-e786-44a9-8995-a551edacbbd1

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/823293

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-07-27 09:43:01 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6pk24tfwrnvcwwwidd53hz76pc7uttrw45upb5z5mh2yodjppvja._file

Verdict:

malicious

RedLineStealer

2d1dea49f82e34123861cf36ae63704941b7e2351e84efa2736a57158c333507

RedLineStealer

4a67aa2ec300cbb230105e608ae084be8522c0ec84a4f0d265a45efec2d592b3

RedLineStealer

72b24e99cdd46d7cee31af6d8858782b775db1753d4ed954774a2b1306d5dd89

RedLineStealer

88efccdbd18a8f217304c67114fba6c25e329e9da1fedbae6e10974980946a2c

RedLineStealer

89a33850501752a857fcd4dcf572ab38be1d61c07273d2c2cb546a84b02a318e

RedLineStealer

b30c723982534b09ac7736e33151c7093403b96e8cbc0c9aa58bd7cfcb6a7e32

RedLineStealer

fa83c0bb710987cdf1c5ed15400d938bc818d20c34af9e96e8cd99fc2ac3a172

RedLineStealer

+ 3'811 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210728-9aag84le7s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

193.56.146.60:51431

Unpacked files

SH256 hash:

7b5c9ad7cd50b874a768799207f8998f2eff78da2718e7ade4eac73715f4cfea

MD5 hash:

9536688861e23157e9d21a299e17c6f2

SHA1 hash:

e2d28ee70af93e198f03456a7100755187fd3c52

Link:

https://www.unpac.me/results/db65cf86-4a9c-4ee6-b4d3-0533d19bc7b3/

SH256 hash:

81badcc20f2016b08699ab1e249529a6347b7431aa1ddd73f44f7afd1a20e2e3

MD5 hash:

bbf2ac9b6ca7b93a5ab098e1f67bf527

SHA1 hash:

7afacc76ee220eb45fa9619635ba8ca3bd6f382e

Link:

https://www.unpac.me/results/db65cf86-4a9c-4ee6-b4d3-0533d19bc7b3/

SH256 hash:

081c02978ac0e1aa32d9340b2221214708f0625ed699340c604f5a54c0ce29c3

MD5 hash:

e9ea5a43b9f69bf1619c55f11a85ba80

SHA1 hash:

6d98a4cfbffa0796a12cf60de88ab508562d8a0e

Link:

https://www.unpac.me/results/db65cf86-4a9c-4ee6-b4d3-0533d19bc7b3/

SH256 hash:

f3d5ae4cb68b6a2b5ac818fbb3e7fe78bf49ce36e768f0f73d61f5870d2f7d52

MD5 hash:

e9b100cdeac17271fa5fd4cf9a9de6f0

SHA1 hash:

bb2123f116bbb8b823245f74a7fe1f687f0c81e2

Link:

https://www.unpac.me/results/db65cf86-4a9c-4ee6-b4d3-0533d19bc7b3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f3d5ae4cb68b6a2b5ac818fbb3e7fe78bf49ce36e768f0f73d61f5870d2f7d52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.