MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0
SHA3-384 hash: 476152e152378767958fb32a2f7b1abcdfdda78cd7eff07e1e7331209e7d1c854f173432ceaeb00988171f5c7104758e
SHA1 hash: 74c71192c081ab99251e7d2192caa37149027568
MD5 hash: 07119e98a4dcec3abe4004a4415ea60e
humanhash: don-december-stairway-connecticut
File name:07119e98a4dcec3abe4004a4415ea60e.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:418'816 bytes
First seen:2022-01-20 06:36:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b599c41ba6f3d2fcbb28babbce596599 (10 x RedLineStealer, 3 x RaccoonStealer, 1 x OnlyLogger)
ssdeep 6144:qXiNJgxctw7auswKZnKxm53rYPvOvCgEvUBQtuuBNrhUGfD64oAIZ:ZHgxct2aoKhmq3rYP2v3I1hUcOnlZ
Threatray 4'443 similar samples on MalwareBazaar
TLSH T16F94E0213AA0C433C4C626314829CFA56A7DF8707A64764373A8377E7F71A81B6A535F
File icon (PE):PE icon
dhash icon fcf8b4b4b494d9c1 (17 x Smoke Loader, 8 x RedLineStealer, 6 x Amadey)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.9.20.111:1355

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.9.20.111:1355 https://threatfox.abuse.ch/ioc/303028/

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/220852/
Detection(s):
Win.Malware.Generic-9936948-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/4814/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61e9030f0f8c757253cf72ae/reports/923d6cae-db23-48e8-b561-bfc995204bf6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/11354e8a-aa1f-4f00-8c4e-fc6cb757392b
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/924700
Signature
Antivirus detection for URL or domain
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-01-20 04:45:14 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7yq4nqotvzw7zrfr4k7jtec6j3e5cje25m45k4r6ks4es6cim7qa._file
Verdict:
malicious
Similar samples:
0d4ba1ff1ded8ceed68d1af69a463506ea7bfe4c92d4d78082ee5c111077ad98
RedLineStealer
560f614418ca04cf5caa6eb9c04f36572fa28fa12aa94a1ed0178305e457a40f
RedLineStealer
8baa0639d8b45406032ae8463871c902c5c1d19e4f3f4c0b561cc7d1a18f3a95
RedLineStealer
a2cac07f9147dff643d6a810b9370d8fc2551a692d95b378fcc7b3086c44193e
RedLineStealer
b0671c01ba85943cc2f01a7442341520d0068fb89c402828f0ae280fab9f8785
RedLineStealer
+ 4'433 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/220120-hdggrsgdg5/
Behaviour
Suspicious use of AdjustPrivilegeToken
Checks installed software on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
53550ff7f5f4415af3921403ceb61516ed96de9977b3bddeb98e2806fa0c51d3
MD5 hash:
bffe2ad5060544e3f91895046563058e
SHA1 hash:
9aef75c0ba7544f75ed8de564119e00f27b6c296
Link:
https://www.unpac.me/results/565e0441-3166-4563-b920-88b3c2ed5c24/
SH256 hash:
7b263dd91a3b5cfd0b23d7278b311554302594ce315d3f3ecce76c50b7dc9996
MD5 hash:
18310af34dea96c7dbfb0e130dce9c4d
SHA1 hash:
58edb207e594c33cf34e773c8fcdf70e4e1dcdb1
Link:
https://www.unpac.me/results/565e0441-3166-4563-b920-88b3c2ed5c24/
SH256 hash:
3007bd9c3d3738268faa22379b815987f1f36c716620b27a460561a8c3b4b416
MD5 hash:
5ac2f4bce675ade1eb5ff3366018b0d0
SHA1 hash:
40b2fbc94f331ba0aabb1f05b077f486eff29b00
Link:
https://www.unpac.me/results/565e0441-3166-4563-b920-88b3c2ed5c24/
SH256 hash:
fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0
MD5 hash:
07119e98a4dcec3abe4004a4415ea60e
SHA1 hash:
74c71192c081ab99251e7d2192caa37149027568
Link:
https://www.unpac.me/results/565e0441-3166-4563-b920-88b3c2ed5c24/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1849426/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/220852/

Comments