MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00e8ac11d71f2448d10354a50ca9268778eb5e19dff458f54b47745bd9e5f665. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 3 File information Comments

SHA256 hash:	00e8ac11d71f2448d10354a50ca9268778eb5e19dff458f54b47745bd9e5f665
SHA3-384 hash:	f57f1cf7d022b70a982e774fd98f28da4c0aac777bb5c2fb75700636a3951e60df8511300bcf3152365bdee2ac3fc52c
SHA1 hash:	bd968e76c77c101be6280d8bde37c08f7b321510
MD5 hash:	1cd146179221cdb8064810dd2d5d39ac
humanhash:	washington-coffee-gee-mirror
File name:	1cd146179221cdb8064810dd2d5d39ac.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	946'352 bytes
First seen:	2021-12-05 09:21:35 UTC
Last seen:	2021-12-05 10:28:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6e87def9f63882a48e57bcc8b42eb197 (1 x RedLineStealer)
ssdeep	24576:2/IfKa7IYsBRSGhTlBU24yOUC5DWBbtus/2bIwmj21:2/Iya7HeBu9UCcBUs/28xy1
Threatray	104 similar samples on MalwareBazaar
TLSH	T14E15F17733CB63CACF674DB2F2540B295A5C8973316214BAB0B0A1A7CCA4E7A4D57538
File icon (PE):
dhash icon	ccb2dc9696dcbaf4 (2 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
185.241.54.212:4129

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.241.54.212:4129	https://threatfox.abuse.ch/ioc/259749/

Intelligence

File Origin

# of uploads :

# of downloads :

251

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1cd146179221cdb8064810dd2d5d39ac.exe

Verdict:

Malicious activity

Analysis date:

2021-12-05 09:23:03 UTC

Tags:

trojan rat redline

Link:

https://app.any.run/tasks/33ceb837-45c7-4f48-8f86-96efb59bcf08

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/211460/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.3043.8762.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Searching for analyzing tools

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a file

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/899/overview

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/61ac84bcfa72c81b5b0c70b0/reports/b876517f-2460-40dd-8826-998d9245ee9f/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/47fa2ff7-4bfd-4754-8562-b2a67de260c2

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/901677

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00e8ac11d71f2448d10354a50ca9268778eb5e19dff458f54b47745bd9e5f665/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2021-12-05 09:22:14 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=adukyeoxd4seruidkssqzkjgq54owxqz372fr5kli52fxwpf6zsq._file

Verdict:

malicious

Label(s):

ryuk

RedLineStealer

780426de24ae46f300fdaf9cbf597c8f2164f7b6c525c0bbcc07dca087be768c

RedLineStealer

a5cf8668fc9624b386bbdad3a3dba28c029945048a7d15a0b0ee41dfe9e0a2df

RedLineStealer

a8c670e05a3134defec2bb6565c6aad83ffebd9465dcf0fc6727f2f550802062

RedLineStealer

c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347

RedLineStealer

c88d90ab7e74383b46c41cc01a5ec7065c4e40cff87fb0c619bb7421704e8af9

RedLineStealer

e313b4fd124a57681c954a72c3a09aa4fd96245df42130fc6ddeaa10d6a4451c

RedLineStealer

f75bda07c2fc02d23c291e0894bdc72923fc6e0f6959e65a3922cb09ef1f1fda

RedLineStealer

+ 94 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:mimikatz family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/211205-lbw18afae4/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

mimikatz is an open source tool to dump credentials on Windows

Mimikatz

RedLine

RedLine Payload

Unpacked files

SH256 hash:

a28c18cc13f1b586d002ed80f7f3afeaa90f142957a8c7d5b521b18396d0175e

MD5 hash:

ffdad578e122a315b068ce9fd9a598c1

SHA1 hash:

130b35fb36f39c8f634f925e65725853067a5e0b

Link:

https://www.unpac.me/results/9c1607c7-9eaf-44d3-b97b-5ce40b30ab9e/

SH256 hash:

00e8ac11d71f2448d10354a50ca9268778eb5e19dff458f54b47745bd9e5f665

MD5 hash:

1cd146179221cdb8064810dd2d5d39ac

SHA1 hash:

bd968e76c77c101be6280d8bde37c08f7b321510

Link:

https://www.unpac.me/results/9c1607c7-9eaf-44d3-b97b-5ce40b30ab9e/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/00e8ac11d71f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/00e8ac11d71f2448d10354a50ca9268778eb5e19dff458f54b47745bd9e5f665

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time