MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f78ba534d6895837850f4b393ef4756446364d602c686fcb27cefd858d228b4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f78ba534d6895837850f4b393ef4756446364d602c686fcb27cefd858d228b4d
SHA3-384 hash: f85c8ed05010e74a07bb633010a5c24fe35acae4e1af1c9e18b8f8c48b46b368068a29c5c62804ec88349e07f215edfa
SHA1 hash: cf0d7519c7920dcac956171dc8fef1cfbd4052ba
MD5 hash: 18361d806862027eda0b32c781bf4350
humanhash: texas-cat-rugby-wisconsin
File name:18361d806862027eda0b32c781bf4350.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'442'771 bytes
First seen:2022-07-07 09:30:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 726a22f55cf9e91b15fd25cd9f82556f (17 x RedLineStealer, 2 x ArkeiStealer, 1 x PhoenixStealer)
ssdeep 24576:lRMfY7Yjc9k7qMYTWlX7Z+nrkc4aHQ/ZaNLA+sCs+l3RuQ55313k:lRtOOrkFaHQ/ZaN0+pl3C
TLSH T1F1B509036A8B1E75DDC23BB461CB633EA734FD30CA2A9B7FB609C53559532C4681A742
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.124.22.20:19788

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.124.22.20:19788 https://threatfox.abuse.ch/ioc/812035/

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/285456/
Detection(s):
Win.Packed.Fragtor-9954665-0
Create hunting rule

Win.Packed.Fragtor-9955169-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/24287/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug overlay packed spyeye
Link:
https://www.filescan.io/uploads/62c6a7f5d5fe19ca50a2ec58/reports/6e8f8c9b-571d-4830-8d24-9c09cf149353/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Certishell
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42326aff-c6cb-4696-a444-75be72aae060
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1026292
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 658783 Sample: bKX1K4Vuh8.exe Startdate: 07/07/2022 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 bKX1K4Vuh8.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f78ba534d6895837850f4b393ef4756446364d602c686fcb27cefd858d228b4d/
Threat name:
Win32.Trojan.RedlineStealer
Create hunting rule
Status:
Malicious
First seen:
2022-07-02 09:40:05 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66f2kngwrfmdpbipjm4t55dvmrddmtlafrug7szhz36yldjcrngq._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware
Link:
https://tria.ge/reports/220707-lg2hwsdah2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
Malware Config
C2 Extraction:
193.124.22.20:19788
Unpacked files
SH256 hash:
25e9d6bab84549180d909c95eb7ab1f5016b404feeed571d4ecf9db60f003c9b
MD5 hash:
e6ed9003e34a57fb662139fd478a734f
SHA1 hash:
5d3677cbcd6f5fbe9b55ec87540a523d8d8096e6
Link:
https://www.unpac.me/results/d7b80b5f-3c69-4110-96cf-6d493f482644/
SH256 hash:
f78ba534d6895837850f4b393ef4756446364d602c686fcb27cefd858d228b4d
MD5 hash:
18361d806862027eda0b32c781bf4350
SHA1 hash:
cf0d7519c7920dcac956171dc8fef1cfbd4052ba
Link:
https://www.unpac.me/results/d7b80b5f-3c69-4110-96cf-6d493f482644/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f78ba534d689/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
Link:
https://yomi.yoroi.company/submissions/f78ba534d6895837850f4b393ef4756446364d602c686fcb27cefd858d228b4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/285456/

Comments