MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8
SHA3-384 hash: ee522ca805a8afb7a245370b4ac81f9a43f156ccaaeb2b34d53623441cfad4c73ffd8279fb8742bfa28b809e5ddddf29
SHA1 hash: 2eba3d61e364e8a40f187556c337809b92e06914
MD5 hash: 400ee0714dd95e2444a1242483027271
humanhash: queen-pluto-lake-salami
File name:400ee0714dd95e2444a1242483027271.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:608'768 bytes
First seen:2021-07-22 08:01:02 UTC
Last seen:2021-07-22 08:47:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f1287ea8340d83d7c6e292a6b7d8dbf5 (3 x RaccoonStealer, 1 x RedLineStealer)
ssdeep 12288:ysds94MIKf4aiYSh1IP4ZD0cw1eyPi1iM2T:I46f4uSXIP+Dx/ya1iM2T
Threatray 483 similar samples on MalwareBazaar
TLSH T1C3D4128036A1D932E1790A7148F3C7961BBFBC126979950B7B8437DF2E702C192AD367
dhash icon 4839b2b0e8c38c90 (11 x RedLineStealer, 10 x RaccoonStealer, 2 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
400ee0714dd95e2444a1242483027271.exe
Verdict:
Malicious activity
Analysis date:
2021-07-22 08:04:28 UTC
Tags:
evasion loader
Link:
https://app.any.run/tasks/fce452ea-9a73-436b-90bf-749b82992c02

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLineDropperAHK
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173253/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37273993.32587.8299.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a00e7fa1-1568-490f-af61-83cd6b0d7c6e
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/819996
Signature
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample or dropped binary is a compiled AutoHotkey binary
Uses known network protocols on non-standard ports
Yara detected Autohotkey Downloader Generic
Yara detected Evader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-07-21 12:03:01 UTC
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7aaei5rggx6jhifr6yjgms6zwczb7ihir7khhohstdmxe3cd7gua._file
Verdict:
malicious
Similar samples:
26d31be8dd31c668f900e9a88cfa3143e09cd149e6ced88c8f3db1992bbcd679
RedLineStealer
571b3f0b4685473b424f7fb3b67344cd1441930fa7f966e3a4cd41875fde8de3
RedLineStealer
5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32
RedLineStealer
7525f2c1ccec025adb8f773ab10ecd9cee7bacec9949a7415ad239cec969bfb8
RedLineStealer
78917f8c2ce40501bb4bf955f14e9f96dea7aa003bc6d21611d6c771a7df6a16
RedLineStealer
ab8c569869fe2fbb65e917a16d9294281bb0d092856a3f114ff1ee4750f599e1
RedLineStealer
d125379e8708c90bd0f34a7b36a1684c3fe3e5dd56915b1087de4c4f86a725de
RedLineStealer
d34e63dbaeb352c7fbf69e3afcd140ca188aaf9492bbb209401bdbcc6028b07c
RedLineStealer
+ 473 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:mix 22.07 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210722-zwz6rmwwms/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.215.113.17:18597
Unpacked files
SH256 hash:
125bbed66ff7c6535590bbd2341f0e3e8394391a9263ffcf3c07ae043a81fa30
MD5 hash:
a75968486cddabd6a3e9a191cf0c4d24
SHA1 hash:
64143e8e7a57bd47b83d79a431e4914bf146a8c7
Link:
https://www.unpac.me/results/34dcac2f-1afa-49b4-815e-ab8e3ab13661/
SH256 hash:
f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8
MD5 hash:
400ee0714dd95e2444a1242483027271
SHA1 hash:
2eba3d61e364e8a40f187556c337809b92e06914
Link:
https://www.unpac.me/results/34dcac2f-1afa-49b4-815e-ab8e3ab13661/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1459569/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/173253/

Comments