MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c
SHA3-384 hash: 715ed64938cd4f5e56cdf0fcbb866fb55a33cb377364a369f24777f93273797fcc74f4d58dcc6ee8256da1b5c4e4b6d6
SHA1 hash: af478049e6be1b4586cf4b8da45454e8b14d0cd0
MD5 hash: 630466a7abb256eee19c7de3772de2f7
humanhash: nuts-uncle-oklahoma-fourteen
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:494'016 bytes
First seen:2022-11-19 10:02:04 UTC
Last seen:2022-11-19 11:38:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 045163335c785d665aeb43938f4d94be (6 x Smoke Loader, 4 x Amadey, 3 x RedLineStealer)
ssdeep 6144:i1kfBQi33W4wri5hC1FcUW0jb8+WcwTm7jpPnFwCLLObfwB:iKBQg+iDKFnjWcwTYxqC3O
Threatray 17'617 similar samples on MalwareBazaar
TLSH T1CFB4E1307670C4B2F9B14670C465CBA5A9B9E9607814D9033654FBBF3E30F8E5A6E239
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2b97ceadd6ab3311 (3 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from http://193.106.191.30/MicrosoftKeys.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
324
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-19 10:02:58 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/7dfead5b-f308-40df-be00-d7e8f61228e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/336087/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.4835.24763.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connecting to a non-recommended domain
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
compromised greyware overlay packed
Link:
https://www.filescan.io/uploads/6378a9d707c3f5e84a01fe03/reports/1f5e4d42-3ae0-4efc-b1b8-42bbe2b37009/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/59f278ed-0205-4462-b3c9-fd15c2bb9b50
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1117101
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-11-19 10:03:08 UTC
File Type:
PE (Exe)
Extracted files:
79
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=asnssolkspparknftcun746mhg5s7qiyrk2wroiei7dz7ydz2moa._file
Verdict:
malicious
Similar samples:
4aa2fb304cd3142f4332e1df78fb05c9fcfc9cf4c45a4b4313e1ab3d8c196cf3
RedLineStealer
88a6579adeafcfb7ed5c9bcd054253ca0c33a2158624cf73c3f528e16add5f1e
RedLineStealer
befb72b0133ceb62aebbc2cb3cec399f89b3a99f6cb163d494f1176685ed19fc
RedLineStealer
c8bf9f62050fd5ea2b05756d42aa309b142fda4109b2bba7d7d0b0bb8e2db289
RedLineStealer
de5a55573afe040af55517efbd83afc4c686e8c707fbec6ccdf8cdfdf39077dc
RedLineStealer
e98edce318f2ee5d241b87ca9305f8ed72cc8eb5a21757d8430c4152d0a47c87
RedLineStealer
+ 17'607 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:dozkey discovery infostealer spyware stealer
Link:
https://tria.ge/reports/221119-l3cfwsfa26/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
Malware Config
C2 Extraction:
193.106.191.30:47242
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/641ee6b1-da63-4f09-b365-2f1a2d961d65
Unpacked files
SH256 hash:
f9c52111ffe261b94da8b96278152b988aedd15f6ac939519f63d179a91305d0
MD5 hash:
d1824b431367ee3bd6b56a82a5f3a722
SHA1 hash:
ac9459eb5a25c1426844b09100c61b4dc9957476
Link:
https://www.unpac.me/results/eab839bb-1d83-4447-bc8b-25fd8f540e13/
SH256 hash:
cfc4f7340df2681941fe68d8112c29125ceba8bb26311e0ae7f9c732ddc1c4ac
MD5 hash:
c4031dca5885b1f0e70ac9447f63a0f0
SHA1 hash:
3140c555975a691fb89bf0a1b093984df3899a7a
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/eab839bb-1d83-4447-bc8b-25fd8f540e13/
Parent samples :
af29edc2d7bf569d5bef55e69504da3c6404c7df7b10d3145faf6d6d31e347ea
6817f5bc2c65ce63767514f18c3f1a78dae713876cdae0f79b5cc1e55de71799
1e1c1160f517a2e9186861a2e2bb104fa33711c7d7f40f04cda721f50d62df5f
474b857a9ae1d311198c37c13617c00b1d111f3f2a1a462aaef75dda5a9e37d1
eb452bc0241954ff78b9780c4710f5657ab3bbddd8ba2316afe13379ed86ea3c
44ae9f2c44267535f54270ed2c4d03f937f40a524566c5f8ebd1876b937a503a
de53065c8fe0e17ab1b9875ad9d4bbefdf3ee2f749326bc5793f2da509f17da5
64e9f03e59e64fe9a95a9966f0b4550a6f2c99ad99a08d45a0c79d383d720d1d
369f8d75c0b2934f02ccac05557fd46e00b34bf2e8b793939b0ee32813385fe7
de5a55573afe040af55517efbd83afc4c686e8c707fbec6ccdf8cdfdf39077dc
88a6579adeafcfb7ed5c9bcd054253ca0c33a2158624cf73c3f528e16add5f1e
049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c
2a7b4330b0f92e2f07a053d2e4da5bd28de34e736c37ca7d799642519f6a6ef5
d7b731af07c7cd86b2d25c314ef0bff43e3c935daddc6d6d60a2efb8c3fa91c7
9cb696bee3960c077367c53ee76957cb904b2888029e0188a28e71b809600153
47132890ae330f4d234910177cedd8c55f2e2221318708c0957abbe723092efe
99d3e8e677488bed6f7ab10988da7eff0abc3032659aa1306951d9e60dcd1524
5bf5b424ba0cedbcf47b4ea6830071903ffec54b3e84900bce043ebc3b7e11ec
6bc8101e00a14f8ddab14d986ab1fd0eeaa9a69f10f73697edbae8b2e1bdcbf3
f29190f00b2eb1f1452fb444e4668e8eeb23a7f29b97d3824e9ed688e8c8135f
08eb889660d9302844e073a90f01a999dd220ef609d276d415c6c67032db69be
SH256 hash:
8710af070ebed089a686d048266f352643b7913e3cf06632ff5f2a72f57c631f
MD5 hash:
2b8ceeccc677efd4b5f7c08cb4c77669
SHA1 hash:
11f787f4b882def1f0838554aa5460393ad922d7
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/eab839bb-1d83-4447-bc8b-25fd8f540e13/
Parent samples :
af29edc2d7bf569d5bef55e69504da3c6404c7df7b10d3145faf6d6d31e347ea
6817f5bc2c65ce63767514f18c3f1a78dae713876cdae0f79b5cc1e55de71799
9cc5b5b9f77b61631e3e85e834b22e4b1685a6d43dc3b1c813b879e263b4a438
5c51b93c1c6c3417222b12f14d7182d2f6892da208bd363ceb8487d23c7d8361
0e056e7006718f2df48cb25367ad37976f514ac447ceacbd0e41fe1a7ba0fec0
1e1c1160f517a2e9186861a2e2bb104fa33711c7d7f40f04cda721f50d62df5f
474b857a9ae1d311198c37c13617c00b1d111f3f2a1a462aaef75dda5a9e37d1
9de65be7854aa8dd5431e5633ce0a8844fe9e688f2a79bac6ffff076757adca2
24847bc703b9e0c27313a537c53a51757fded4d1179556a0ae5c1af39927134b
b10008bb099f081741456daf29af0a24934b4828e4071e934c3ebdf2d600fd71
eb452bc0241954ff78b9780c4710f5657ab3bbddd8ba2316afe13379ed86ea3c
97b4110323e2aab7ab3c10be8f06d18e65cbfafbbe87f5ee77dc8cc42f150b5a
44ae9f2c44267535f54270ed2c4d03f937f40a524566c5f8ebd1876b937a503a
de53065c8fe0e17ab1b9875ad9d4bbefdf3ee2f749326bc5793f2da509f17da5
50da69523a08e478018c6534dbf295c6d3d8df9715eee58ea2555ea499c3a2fc
64e9f03e59e64fe9a95a9966f0b4550a6f2c99ad99a08d45a0c79d383d720d1d
369f8d75c0b2934f02ccac05557fd46e00b34bf2e8b793939b0ee32813385fe7
de093f8b734075fb4d4529df0b50149e791f6ccc3d927a28d610dbcd2ed73ee2
14d5376e3237559a314402aec6e3ab605304d32f3842d75fe2eda0e836688b8c
b4db22da0f2afe09c61703ba7f011fcc6be2d9162df29c23f5643ee301f069e2
4ad1b4779ea5af32de8b22fd966b7a9bb3929d091e9e61c35c7b25d5c1b1b550
4aa2fb304cd3142f4332e1df78fb05c9fcfc9cf4c45a4b4313e1ab3d8c196cf3
de5a55573afe040af55517efbd83afc4c686e8c707fbec6ccdf8cdfdf39077dc
88a6579adeafcfb7ed5c9bcd054253ca0c33a2158624cf73c3f528e16add5f1e
c8bf9f62050fd5ea2b05756d42aa309b142fda4109b2bba7d7d0b0bb8e2db289
befb72b0133ceb62aebbc2cb3cec399f89b3a99f6cb163d494f1176685ed19fc
e98edce318f2ee5d241b87ca9305f8ed72cc8eb5a21757d8430c4152d0a47c87
049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c
2a7b4330b0f92e2f07a053d2e4da5bd28de34e736c37ca7d799642519f6a6ef5
3e79825ebc2073617eac207ffaf639a4dd97f7436b4b25b7226617adc59b689e
9f802a2ecff20f749a93b197cb18ae6b67eeca85b12f801f3d5de0bae0c54066
d7b731af07c7cd86b2d25c314ef0bff43e3c935daddc6d6d60a2efb8c3fa91c7
fae696911780d0bf4fc2a2a6ddee82b26fca9bfe92a8908051c8945d97ceb4e7
db266ea1e5adb4a44965e8becef1d1ad7b41ba48d45afeff56aa2f229e16f165
3d68b1e6c89a05f0ccdc50ca3144123c736c31bc818e5078258028abb59401c2
cc8321982633efd133f144be8c2d287462dc8faf858fceccc7f4722544b3a749
9cb696bee3960c077367c53ee76957cb904b2888029e0188a28e71b809600153
90881c224d77520a4cffb5ff0dca516bc22474fe3eb8aecd565a08c9eee54f3f
614e1692785d9958b1cedba4ba648f3a5ba971100e3c89df9b12cf80a68100c0
a7195b4af46ea73c5ee41a67672c75d1c3204be7534251b59bab04bb18f4a8d2
47132890ae330f4d234910177cedd8c55f2e2221318708c0957abbe723092efe
53b4f1f0c960519ef57056d3ec9206701ed03f8076bcdab819fd033b66a48970
99d3e8e677488bed6f7ab10988da7eff0abc3032659aa1306951d9e60dcd1524
5bf5b424ba0cedbcf47b4ea6830071903ffec54b3e84900bce043ebc3b7e11ec
6bc8101e00a14f8ddab14d986ab1fd0eeaa9a69f10f73697edbae8b2e1bdcbf3
efd6e59196f1b2d66a4d9e36e9c64024c28dc4f5c88fcd047d1acf15a69b7bef
051c7fd0c329d57420826e84e0ff7888f7a2ea91176e1a39a5139a6422bb117e
e51d7948a04eb3088f904b424b15405ed335fb86638a299fd4b07da25e65f0bc
adea78b4c7b6b76b80e581b55f082cc6df741b0e450706d3e10922589a604d7e
f29190f00b2eb1f1452fb444e4668e8eeb23a7f29b97d3824e9ed688e8c8135f
3c5e247cb1e9728d3243c7eb4f814a1d42d35041a00802d50afe80a0da36b3a7
08eb889660d9302844e073a90f01a999dd220ef609d276d415c6c67032db69be
SH256 hash:
049b29396a93de08a9a598a8dff3cc39bb2fc1188ab568b90447c79fe079d31c
MD5 hash:
630466a7abb256eee19c7de3772de2f7
SHA1 hash:
af478049e6be1b4586cf4b8da45454e8b14d0cd0
Link:
https://www.unpac.me/results/eab839bb-1d83-4447-bc8b-25fd8f540e13/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/049b29396a93/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1
Create hunting rule
Author:Florian Roth
Description:Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022
Reference:https://twitter.com/cyb3rops/status/1499514240008437762
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/336087/
  
URLhaus
https://urlhaus.abuse.ch/url/2396659/

Comments