MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
SHA3-384 hash: 648892a21434ea4bd1d7de3c1005ac8f844fc1327d57eb49684c0df9480ca1cac59ef97101f4496260ad6f22dea973f6
SHA1 hash: eb07419c9af9a3c2f4b9039207dc1806aad17adf
MD5 hash: e868ad695d310b795bb8b69f59fce3a6
humanhash: stream-jersey-king-moon
File name:f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:416'256 bytes
First seen:2023-05-18 14:09:51 UTC
Last seen:2023-05-20 14:58:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ea30b38d7abd4cdbca38be77ee3216ef (4 x Glupteba, 3 x Stop, 2 x RedLineStealer)
ssdeep 6144:CMV/qhrLANASsoFGPR6eoIObRwIzHkv+gULTCvlZ2xBle8TSO:CgqpMNA77oIObq+jLTWC/lJS
Threatray 35 similar samples on MalwareBazaar
TLSH T1A0948D03A2917CA2F9254A7E8E1ECAFC6A5EF9504F0D67DB6358AA2B14711F3C573301
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon a420448090848000 (1 x RedLineStealer)
Reporter JaffaCakes118
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
Verdict:
Malicious activity
Analysis date:
2023-05-18 15:56:23 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/06ee1629-b58b-4dc4-8ea2-b6b16bd8c318

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Sanesecurity.Malware.29322.BadIN.UNOFFICIAL
Create hunting rule

Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Reading critical registry keys
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/646631c2210b83e7c0c7eff9/reports/3de417de-9d45-44a4-8813-7ef8308b64f0/overview
Verdict:
Malicious
Labled as:
Ransom.84989A88
Link:
https://www.hybrid-analysis.com/sample/f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ddbf0bb9-f381-4d7c-9ff9-82121f640518
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1236111
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7/
Threat name:
Win32.Ransomware.Stop
Create hunting rule
Status:
Malicious
First seen:
2023-05-18 13:01:55 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6y55p6vz74kgolmfago7kmpunu5wp3vbz22wy5xlrgql75ugphtq._file
Verdict:
malicious
Similar samples:
0774333fa07a5fbf06d0bb8f974b172d93cb9ed871eec5d497828dd458379171
RedLineStealer
07d2a39f5c3d310fc233d63a5db81605fbc76e9ddc73bafd46990400e686ee22
RedLineStealer
6e9f1b1fa3c2d1dd2a2a8d61258685c64ce1fb38a84ba281fa7c07d59225ef10
RedLineStealer
6eb109c50d1a989cd368291c412b7b099f18be773902c7f459faa9f7e5071452
RedLineStealer
727df79548ea43456317931d6d2afdc98a84856bd1d6779c0dac4d4bc5d3c49c
RedLineStealer
83330099d98691d7270580d13df1175cdedb1f47c412454901026234d090f051
RedLineStealer
93cea09cdb6ed12a8764adb71ad6927e3fdec062bf990fa4f03a0a90b7ca99a1
RedLineStealer
9fe8b148afef5e54b88b76beeccaef42ae37b6387d38fcd8cbd7d509a9f90b40
RedLineStealer
a0e4515ee2de51f5ff5a41b03fd7e993f075c889f297d63143b1620cdcf9d9db
RedLineStealer
b68bd5f437195007eab47596498cf7f8723a6b13631f92c2266a5825c902b486
RedLineStealer
+ 25 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230518-rgqz2sbc4t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Unpacked files
SH256 hash:
e701f8a1ce7fb0576c46c14114dade75eef4a246ed576fb25cba560c84ec26aa
MD5 hash:
280f31017b618a09fd64db32d53c2097
SHA1 hash:
dff674dd2c24f87512935e3ff3116ad92be78ce5
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/9a746555-28ed-4ff3-a029-c88e00c166c4/
Parent samples :
27e294d95832a9b636752af5d1debb924f5516e7d83afb2749f66a65c15a867f
6eb109c50d1a989cd368291c412b7b099f18be773902c7f459faa9f7e5071452
83330099d98691d7270580d13df1175cdedb1f47c412454901026234d090f051
f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
SH256 hash:
8c82f61e77c99f5cc7af49cbca773715931e89a38ee965a015a2c28692ba00d6
MD5 hash:
6b7ed2aca203247445992e467177fcb9
SHA1 hash:
b5752b23f9551b8d5be503e83410292b741a3c37
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/9a746555-28ed-4ff3-a029-c88e00c166c4/
Parent samples :
27e294d95832a9b636752af5d1debb924f5516e7d83afb2749f66a65c15a867f
6eb109c50d1a989cd368291c412b7b099f18be773902c7f459faa9f7e5071452
83330099d98691d7270580d13df1175cdedb1f47c412454901026234d090f051
f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
SH256 hash:
85ba42ca7dc6ed40d2e6003fdfe1e7e31bd89b24e6dc6b4582526b6805b66df0
MD5 hash:
08ecaa03ebe953e6d493c2c03bc027f5
SHA1 hash:
452df5ac8212f01208389903ce76aa4c4a8593d9
Link:
https://www.unpac.me/results/9a746555-28ed-4ff3-a029-c88e00c166c4/
SH256 hash:
f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7
MD5 hash:
e868ad695d310b795bb8b69f59fce3a6
SHA1 hash:
eb07419c9af9a3c2f4b9039207dc1806aad17adf
Link:
https://www.unpac.me/results/9a746555-28ed-4ff3-a029-c88e00c166c4/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f63bd7fab9ff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe f63bd7fab9ff14672d85019df531f46d3b67eea1ceb56c76eb89a0bff68679e7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2604056/
  
Delivery method
Distributed via web download

Comments