MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 7 File information Comments 1

SHA256 hash:	fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995
SHA3-384 hash:	3d3b7564a5e037a8dcbdbdb016c4093abb9b6b9dc0533b1fdca30077154634dcb8d298c0cb9c0f843c0f8ce6113e0f99
SHA1 hash:	fce1b1b3e8453d533f1e1a3e09c9be07e4aecea9
MD5 hash:	113c295681410c02517b52bd6aba932e
humanhash:	uniform-uncle-eleven-illinois
File name:	113c295681410c02517b52bd6aba932e
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	360'448 bytes
First seen:	2023-08-10 18:23:27 UTC
Last seen:	2023-08-10 18:35:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	652c7ff7afcc08a2e9c5186e380250b2 (3 x RedLineStealer, 1 x CoinMiner)
ssdeep	6144:fKXk0q1dKqu9A3Sw5udy+H37xW82V598wzS78wXO:SUz1dKqu9A3J5udVH3FWz9sA
Threatray	287 similar samples on MalwareBazaar
TLSH	T1B374AFC27E917C50F426CE329E3AD2E6363DFD518E59679A2218FE2F04B11E1D563B02
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	70d0d6d2d0ccd2dd (1 x RedLineStealer)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

113c295681410c02517b52bd6aba932e

Verdict:

Malicious activity

Analysis date:

2023-08-10 18:24:13 UTC

Tags:

stealer redline

Link:

https://app.any.run/tasks/3ccc46ed-4967-4ff7-9d20-e2e0fc0f323c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/442019/

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.15423.3232.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Stealing user critical data

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a301a7fd-d5d2-4439-8cf7-1a2495ab0179

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1289614

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

redline

Link:

https://mwdb.cert.pl/sample/fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2023-08-10 18:24:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7vsmusjm24mb4av6xygzwoy4kylk6cghyhq2ptcoekvucjdmhgkq._file

Verdict:

malicious

RedLineStealer

4401ff9bde7c8fa01c34a3b90959ae1e41eba1ca2e0fc6ce57ecce3a34dd25ad

RedLineStealer

7bf3f2e7b01a6def023479988f460ecf9bae1d94379be2e3a3bfc58a0e0644c8

RedLineStealer

829c8a42d65b1587d2067127d22ed243d75c50e3b0830344dd5d64ac6ce390de

RedLineStealer

a58085c322c3b652925c69fcb94127e0aa222b44e2938132ee81f4474b0d97d9

RedLineStealer

e0414dcf39d1df273d8c94d6a977c2443ae0d115e903dda528d87f5d1be10ec6

RedLineStealer

e1d680bc0112e599878b0c7fa09c89082d4d2d8620ed5e1d3a697083741c13dc

RedLineStealer

ed3c455abb23addb14d8f45029a3c5e4e39b4d2a3d3d50e66db88002ce5b3d80

RedLineStealer

fb104405d5f6a628687964d86dc7c6b4d456aa8645d0d618bd91f2102c9c3760

RedLineStealer

+ 277 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:logsdiller cloud (tg: @logsdillabot) evasion infostealer spyware stealer themida

Link:

https://tria.ge/reports/230810-w12ccagd43/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Themida packer

Downloads MZ/PE file

Drops file in Drivers directory

Stops running service(s)

RedLine

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware Config

C2 Extraction:

136.244.98.226:33587

Unpacked files

SH256 hash:

0b1cc59b2185a43ce1da90eddab7f55f643ae9829686b8fb0982fa7b64af9051

MD5 hash:

b08e917456b00ef4b437039ce266e8f4

SHA1 hash:

edee9c741bb3a9bc1d3bb87f2bd71b767d22c76d

Detections:

redline

Link:

https://www.unpac.me/results/43fdcf14-9712-4742-a791-8fa674cbff3a/

Parent samples :

5d6b4e79354059546f003225ed6a08bc4636d66876b714f24440f5568e5e7f81
fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995
43866279c665ce788216110e56726c1b82817ab79bbc9c13be309043455a74a4
879ac9b78fcedbc0534db2577cdf8bfcad6e3b5961c48baa4fe95bfb8de3917c
e70a0a203a7ad5a9b8526cc0615b51bbe5358418e277014847db9b4df774c271

SH256 hash:

8a11205c90692b0cd6301b254c5d4ec4bd5db9481fd58e7ba7826dd7e04ba195

MD5 hash:

2044bc9a88ea12997d065ab7517642e4

SHA1 hash:

81ecb2b2b85caf3167bca41d5eda523e1da6bf8e

Link:

https://www.unpac.me/results/43fdcf14-9712-4742-a791-8fa674cbff3a/

SH256 hash:

d8b205296e8c196a152356fd3c31ccfe5d9c72c681545997d6ad84310ca25afa

MD5 hash:

b41e07a58431a9ae1babac35c2151c91

SHA1 hash:

6e0f4b3a0469e326f1ac055a551fad5b2efd913e

Detections:

redline

Link:

https://www.unpac.me/results/43fdcf14-9712-4742-a791-8fa674cbff3a/

Parent samples :

SH256 hash:

e8a9edfdcc3661ece3a802a83d48d10d29a49121a86c28753bf91a2ddb9c67e9

MD5 hash:

3c8a9ab8614b99b57bce073730b80ec3

SHA1 hash:

2055ca034db1df143e635a78da64e91ec8277285

Link:

https://www.unpac.me/results/43fdcf14-9712-4742-a791-8fa674cbff3a/

SH256 hash:

fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995

MD5 hash:

113c295681410c02517b52bd6aba932e

SHA1 hash:

fce1b1b3e8453d533f1e1a3e09c9be07e4aecea9

Link:

https://www.unpac.me/results/43fdcf14-9712-4742-a791-8fa674cbff3a/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd64ca492cd7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd64ca492cd7181e02bebe0d9b3b1c5616af08c7c1e1a7cc4e22ab41246c3995

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/