MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff4349856d76d02882e6affb27c70553dcdca030a4efbaf051a1f4edfe7183ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff4349856d76d02882e6affb27c70553dcdca030a4efbaf051a1f4edfe7183ec
SHA3-384 hash: 586563304f6d71a85014635bba3ae46e7a032e68c214ba384a1abac27216ea95b4b0320e6785c88d4fb7d42dbf93b33c
SHA1 hash: d938d454f539a58aca289592e3e61af6ec7a9270
MD5 hash: 9ed95b294135376f51ae5bfaeb59024e
humanhash: moon-massachusetts-monkey-arkansas
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'407'424 bytes
First seen:2022-10-27 21:44:34 UTC
Last seen:2022-10-27 21:55:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1b62f5ec48faa08ab096dfae72734859 (36 x RedLineStealer, 5 x ArkeiStealer, 1 x PandaStealer)
ssdeep 49152:8yzRi/S6AJ9fcSPiVCTxQo6GKHVK3Jpyfg+hESIeldM:8yzRi/S6AJ9fcGiVEcGyVcJqEneldM
Threatray 1'174 similar samples on MalwareBazaar
TLSH T18CB5BF3AE70615B4D76356B1C28EFE7BDB04B6348025AE3FFF46EA0CA4734126C85256
TrID 42.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
16.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
13.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.6% (.EXE) Win32 Executable (generic) (4505/5/1)
5.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://79.137.192.57/tool/softwinx86.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/325172/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.12088.9094.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/46144/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4591f63d-adbc-4330-9a12-267741898bd6
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1099844
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff4349856d76d02882e6affb27c70553dcdca030a4efbaf051a1f4edfe7183ec/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2022-10-27 22:20:52 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=75butblno3icraxgv75spryfkponzibqutx3v4cruh2o37trqpwa._file
Verdict:
malicious
Similar samples:
0dea9964c6e2ad110ad9a26a2e25417afa7b2ed990362faa746fa81cb8a303cd
RedLineStealer
6a0cdcf7adb04dabba97a3cf04e4345bcfd88512cdd9fd59e502255d8768563c
RedLineStealer
824790997e40228c635b02fa75148e6e53b28ce5062509614bcad4570f6a455f
RedLineStealer
a334fa92fab1199f16a272b0f2f63465750f98bed946d23f8f7ae498206ca553
RedLineStealer
a755ddce5ccba523434a36c677d058baef63ecb90e33670a96a70efc7978d411
RedLineStealer
+ 1'164 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:1310 infostealer spyware
Link:
https://tria.ge/reports/221027-1l3dbadeg3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
RedLine
RedLine payload
Malware Config
C2 Extraction:
79.137.192.57:48771
Unpacked files
SH256 hash:
0d2f1e5928af465732cb559dcec78b45d427606c6d0e9b72ee2bbde4fddac757
MD5 hash:
5676851c6a771dc0ef8bcf1d767a2f07
SHA1 hash:
74175d5d6e7f3e940e08bcc13197276661455e62
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/3372abc1-3723-4257-bbb7-129b051a705a/
SH256 hash:
ff4349856d76d02882e6affb27c70553dcdca030a4efbaf051a1f4edfe7183ec
MD5 hash:
9ed95b294135376f51ae5bfaeb59024e
SHA1 hash:
d938d454f539a58aca289592e3e61af6ec7a9270
Link:
https://www.unpac.me/results/3372abc1-3723-4257-bbb7-129b051a705a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ff4349856d76/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff4349856d76d02882e6affb27c70553dcdca030a4efbaf051a1f4edfe7183ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/325172/
  
URLhaus
https://urlhaus.abuse.ch/url/2378332/

Comments