MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4b5eac00cd2439b6954c030b91702e2ebefe39e5ed5035225c6460f46eaeeba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	f4b5eac00cd2439b6954c030b91702e2ebefe39e5ed5035225c6460f46eaeeba
SHA3-384 hash:	bc645ecc8c76c56e96efcf3e6c574836eaea63e60d781caa20599e16523e4157dd938828dc419f81c0ae287e9543c62b
SHA1 hash:	4114bac8945a6793fbdf65ecccc838d2c43d4851
MD5 hash:	ff48121575b7fe44d1cb91a41ed2590b
humanhash:	july-march-oklahoma-gee
File name:	ff48121575b7fe44d1cb91a41ed2590b
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	440'320 bytes
First seen:	2021-06-24 08:04:00 UTC
Last seen:	2021-06-24 09:02:32 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1e17a996886aa2657a4de6c042170d2c (3 x RedLineStealer, 2 x Glupteba, 1 x Formbook)
ssdeep	12288:9hKLD7KtCkPst0GrWtL7jJFjOMhJsUcxe9:eLD7K7r5Z1FjOM9cxe
Threatray	1'944 similar samples on MalwareBazaar
TLSH	B694AE10A6A1C035F2F712F89A7993BC553E79716B2450CB12E5EAEE16347E1EC3132B
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ff48121575b7fe44d1cb91a41ed2590b

Verdict:

Suspicious activity

Analysis date:

2021-06-24 08:05:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/09fbf63b-1cf9-424b-9f7c-068e65aca2aa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/167889/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.14040.16211.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b720a75a-92ea-410e-81c0-a59ab674bb13

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/807248

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f4b5eac00cd2439b6954c030b91702e2ebefe39e5ed5035225c6460f46eaeeba/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-06-24 08:04:27 UTC

AV detection:

20 of 46 (43.48%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6s26vqam2jbzw2kuyaylsfyc4lv67y46l3kqgurfyzda6rxk525a._file

Verdict:

malicious

RedLineStealer

26ca6dacc6663e26b97ea871fb61e8d4a83b341dfae8b34648993d693137a73f

RedLineStealer

27c745cc0cd7404d2a4d3d83e8c0f8a989996e875ceaf6b1889ae8677d097864

RedLineStealer

341041d0a586d0c8cc0f8e9b870dc3961fb95ea2593497df88b40cbed79813ca

RedLineStealer

381f46ccd38428d37da5ef3930b7b43dacfcebaad1d9e57b997d0f6af89fdef3

RedLineStealer

3ef2031bfa11d5d3185989e60d8ff3568231c78628ff6bb851ae135d222a88a1

RedLineStealer

4f3a351455832dca36b70f79c591d224fd52865d5b7b47cab749e8791044d625

RedLineStealer

822e5420021bf77c607830879971290f8bef18e94ec2ac4ac36c60d2c062224e

RedLineStealer

8f505de01044f7c78890ea859ac813af388145086cc3e84719913eaf53fd2d18

RedLineStealer

e87c87c4a26902bc8bbd9993162a98bfb67bb20f9b06cfc0084f5301bec9b816

RedLineStealer

+ 1'934 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210624-czeq54wa62/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Unpacked files

SH256 hash:

d3a86e8c7dfc6da4450f1a19e214637dc87e4bf9e0ad30034803ab80cace095c

MD5 hash:

cb5fc5dd3ba9fdd7af4b8eecf33f77d5

SHA1 hash:

d2bf6ecc946301c58381a88bf12d74204314b7e8

Link:

https://www.unpac.me/results/77766287-015e-473c-80d2-9fd1c819efe8/

SH256 hash:

a3774922e16ff1224a3e509b6fffc7c1dabe5a9a680539608b78839e481d7f1e

MD5 hash:

651e96a0d52076aa5ed2d82739b5c9b1

SHA1 hash:

b1ccd75ad0feed1d11deecb72ef0abac5e3ecf09

Link:

https://www.unpac.me/results/77766287-015e-473c-80d2-9fd1c819efe8/

SH256 hash:

e13e35685114980f612af2304d7916557b03dc43609ada58de42bfa1bd5929d1

MD5 hash:

d73b577cdc3854b7ba4b09f17a84e1db

SHA1 hash:

0b60823181914658cc07e8629fc9b5ddfcdf1fee

Link:

https://www.unpac.me/results/77766287-015e-473c-80d2-9fd1c819efe8/

SH256 hash:

f4b5eac00cd2439b6954c030b91702e2ebefe39e5ed5035225c6460f46eaeeba

MD5 hash:

ff48121575b7fe44d1cb91a41ed2590b

SHA1 hash:

4114bac8945a6793fbdf65ecccc838d2c43d4851

Link:

https://www.unpac.me/results/77766287-015e-473c-80d2-9fd1c819efe8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f4b5eac00cd2439b6954c030b91702e2ebefe39e5ed5035225c6460f46eaeeba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.