MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f60bc8096b41d18db02ff4bec366fec9f024ca0bc769758251e7f88f96260114. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments

SHA256 hash:	f60bc8096b41d18db02ff4bec366fec9f024ca0bc769758251e7f88f96260114
SHA3-384 hash:	947e94ea083565d94096c263ed2318f1148fe07de5ec63cd341678716c8e87bb2e294dda15dd2ae029aa6b5382c9caf4
SHA1 hash:	d1c75433ed1f692407c9e84defe7868fbb8c5c3e
MD5 hash:	fb211ce5e4ba8d453a771a0bc1ca4a41
humanhash:	florida-five-four-indigo
File name:	fb211ce5e4ba8d453a771a0bc1ca4a41.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	283'136 bytes
First seen:	2021-10-12 08:48:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	613eed189326e5150348769c0b41fcc9 (3 x RedLineStealer, 3 x Smoke Loader)
ssdeep	6144:8BDB43c/wkIULMNYz/dAt267n/ah57Vx98aC/B+Ng7yE:IB4QrFLEY7dOwH8v
Threatray	2'591 similar samples on MalwareBazaar
TLSH	T18F54E10171BCDBB5C5E71671887CFB914B7B79121A3191CB7B683B7A1EA02C06B3A352
File icon (PE):
dhash icon	83bcdcac9c8cb484 (3 x Smoke Loader, 2 x RedLineStealer, 2 x Loki)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

fb211ce5e4ba8d453a771a0bc1ca4a41.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-12 10:07:30 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/99bb42a7-1aa7-4c61-8111-b44a97cb3911

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/196835/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.30436.30143.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fba5b487-2599-4575-bf2f-1170e69e499d

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/868492

Signature

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redlinestealer

Link:

https://mwdb.cert.pl/sample/f60bc8096b41d18db02ff4bec366fec9f024ca0bc769758251e7f88f96260114/

Threat name:

Win32.Infostealer.Generic

Status:

Suspicious

First seen:

2021-10-12 08:49:07 UTC

AV detection:

15 of 39 (38.46%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6yf4qcllihiy3mbp6s7mgzx6zhycjsqly5uxlasr474i7frgaeka._file

Verdict:

malicious

RedLineStealer

1e1deef0a751a50e5afd6524e5c4e254f02936922e3d2da42e003546e761ec54

RedLineStealer

3f325a237265eac17786e79dab8fd11688d7022755982385b8ee17de035570d5

RedLineStealer

6ed0e0fc4fc180454a9ebb07cf9cebecdc7595bde25f883f0360e1fc5cde77a3

RedLineStealer

b09e1e3ad712f773066bd497bb61406ff0c3f95746759e68e410a39184ce11a9

RedLineStealer

c2dd287121b9ecbd07a1f4ca65b433e2d56df56f360c7f2037d17845a9705f5e

RedLineStealer

d65dc2b63a0f4c3d6d66aa6e39d377c2a20cd428ca861f019df2ccb730184f9f

RedLineStealer

+ 2'581 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:money discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211012-kq132sbhg6/

Behaviour

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

45.142.215.47:27643

Unpacked files

SH256 hash:

3500d7b0bc4db098a412eb4d2abebac40bbc56717c12eef9a32b7548e9924868

MD5 hash:

d8540d6c9c95953ea64f7796995039b9

SHA1 hash:

bfe1db192fc199753b5e7991ffe350ef806f97aa

Link:

https://www.unpac.me/results/4a2ffb03-af38-4ba8-9bb9-9ef561b9a3db/

SH256 hash:

025490a0122587496371d3bbec4157973a60b89a89287bf041601c08195e8f0d

MD5 hash:

e8c5ff7cd7dcbab543321a8b9c44c93b

SHA1 hash:

9be495a150eb266fc041f14408111df3322e684f

Link:

https://www.unpac.me/results/4a2ffb03-af38-4ba8-9bb9-9ef561b9a3db/

SH256 hash:

6b45f30bd4774c1b3c6a8d8df7625bdcbf2d4fea760174307dfc25a65b785fb3

MD5 hash:

e7c7cfc2f959caf3f92aad0821b16c17

SHA1 hash:

50a41f35cc52f0fcfd41e7a39184cb4123a4a656

Link:

https://www.unpac.me/results/4a2ffb03-af38-4ba8-9bb9-9ef561b9a3db/

SH256 hash:

f60bc8096b41d18db02ff4bec366fec9f024ca0bc769758251e7f88f96260114

MD5 hash:

fb211ce5e4ba8d453a771a0bc1ca4a41

SHA1 hash:

d1c75433ed1f692407c9e84defe7868fbb8c5c3e

Link:

https://www.unpac.me/results/4a2ffb03-af38-4ba8-9bb9-9ef561b9a3db/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f60bc8096b41/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f60bc8096b41d18db02ff4bec366fec9f024ca0bc769758251e7f88f96260114

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.