MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886
SHA3-384 hash: 6580f6e4c94033f2005ef86f470650f0311b62038ff816dffb7af74c23ad8b11bfb5420aeac0cfecb2082eee31e4c863
SHA1 hash: a8a42de4640849fa36ca2ee9918825b0dbe3bbf0
MD5 hash: 94fa890b7a91f842e006e1c7c795b616
humanhash: december-charlie-nine-grey
File name:SecuriteInfo.com.Variant.Fragtor.28226.81.26299
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:385'536 bytes
First seen:2021-10-04 02:01:43 UTC
Last seen:2021-10-04 02:48:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c15bb6cf111ec297d5d1e54944f0caf3 (6 x RedLineStealer, 4 x ArkeiStealer, 3 x RaccoonStealer)
ssdeep 6144:IcZIY/cLq84cQZ8TH20w5sarZmdY8Ge+NEIOEDk/U9F+PJF6AnhrROhxxpeTr/et:/I3P4cQZaH24arP8G9Ntf9FEF6Anizxo
Threatray 2'440 similar samples on MalwareBazaar
TLSH T10B84D038B291CBF6D631C131AB16C3E0496EFC6C5C29568F6B982B1F5F7D3929A21305
File icon (PE):PE icon
dhash icon fcfcd4f4d4d4d8c8 (5 x RaccoonStealer, 5 x RedLineStealer, 2 x ArkeiStealer)
Reporter SecuriteInfoCom
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Fragtor.28226.81.26299
Verdict:
Malicious activity
Analysis date:
2021-10-04 02:04:05 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/777bd1d9-3b1f-44f8-8881-91e3d2d6d5b6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/194399/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.28226.81.26299.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Launching a service
Creating a window
DNS request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Deleting a recently created file
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d2d02653-6d87-4ebd-a1c8-ea38d5353b22
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/863595
Signature
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-04 02:02:09 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7kadei4bw2c6tp56svrlb4ds4edv6kzmole63esmnwjtivo23cda._file
Verdict:
malicious
Similar samples:
0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde
RedLineStealer
11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a
RedLineStealer
1d3f5be570caca4c2efbfee7e7e08d81704e0a40fa19b1df5b0c8a1baeaa6b21
RedLineStealer
2acb4c85d29625922f70b618144eb81f4427998aa52c06e2130527972a8bc0bb
RedLineStealer
45658721ebbfda843579b6e9007d01a37b4083cf990a7eb02d681c11f1221afe
RedLineStealer
465f36fde76cb16a578da90f4b64df8da4e9d67eb120ac65b80003bdb904b2ed
RedLineStealer
73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e
RedLineStealer
a2f89bfff46acc98334846bb8a79074e11f8d4fb65bdaf971cd67b89b735c7b0
RedLineStealer
b86ef6990c59e33deca76103b740084871993a9c417b2b802c608c7604ea8b25
RedLineStealer
c0229d60231c1631796fb5f3bb37f8a814e599bafc0b4f72c17c0e232a2e3176
RedLineStealer
+ 2'430 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:paladin discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211004-cf6a1sfhcq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
178.63.26.132:29795
Unpacked files
SH256 hash:
369173cd39240e2bcfea6193f8c61a7a7d64d7fe3518748abe35ddaf9a47bee4
MD5 hash:
d4c01e4a11d5f3a15d1238adac75341b
SHA1 hash:
7f03fe7ab42282ff8d71f08ef864ec91dcc7e820
Link:
https://www.unpac.me/results/55135c08-de67-4514-92ea-6b1acc24a583/
SH256 hash:
7d80bb48dbc775cdfff203da1d4450ec57c22375d4ba2f917b5425cdbdd41831
MD5 hash:
b830b6f7c2c026ce163a9bda0d44b570
SHA1 hash:
5e3231d95c99d2582f6b60d89cec37e57717d1c6
Link:
https://www.unpac.me/results/55135c08-de67-4514-92ea-6b1acc24a583/
SH256 hash:
b439f898061b04fa803f826b57c330336f93dbe6949e27ad0da86422781ffb7d
MD5 hash:
19f232c33a1c2f36c26dd4b9b7fe3001
SHA1 hash:
155928c673cf5dec3b558783da746fead5526368
Link:
https://www.unpac.me/results/55135c08-de67-4514-92ea-6b1acc24a583/
SH256 hash:
fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886
MD5 hash:
94fa890b7a91f842e006e1c7c795b616
SHA1 hash:
a8a42de4640849fa36ca2ee9918825b0dbe3bbf0
Link:
https://www.unpac.me/results/55135c08-de67-4514-92ea-6b1acc24a583/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/fa80322381b6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe fa80322381b685e9bfbe9562b0f072e1075f2b2c72c9ed924c6d933455dad886

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1653255/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194399/

Comments