MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9
SHA3-384 hash: bc9d161f8257aca1f03699016f20ae2433237835e9200d3dfac4bf1402c9b673e14822b2fb8159a88f0cb2171fc3a9d6
SHA1 hash: 04cb30a014d50db1e5fc438cd17c8b3c97d2c3f6
MD5 hash: e42d69acb75be7780874c9ea58e4aa46
humanhash: zebra-lake-fanta-lion
File name:05a0f7012de4482c552ffef6972720973144444935728.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'400'640 bytes
First seen:2021-11-15 12:31:47 UTC
Last seen:2021-11-15 15:37:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e48cc266501c282987b27f2c1f654e2d (52 x RedLineStealer, 3 x RaccoonStealer)
ssdeep 98304:CL8iGmxa5irBPKblY6/k/5/u1MBQ2ydYMQVmaA/Qd0dQZGWzyP:c8FmxaYrBEMB/u2AigQOdg3yP
TLSH T13616336F86CF8602F1D79DBF8B293AD5F0EB2B24ABC93093390524C26CF58594C36564
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.142.212.122:21523

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.142.212.122:21523 https://threatfox.abuse.ch/ioc/248362/

Intelligence

File Origin
# of uploads :
3
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205926/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Trojan.Generic-9907417-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Launching the default Windows debugger (dwwin.exe)
Connection attempt
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% directory
Running batch commands
Stealing user critical data
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61925344dec3347825a525b1/reports/b1b94bde-6857-428f-80d7-d55933c4d4b7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac74f8c5-e4e6-4721-982b-ac01e0ece729
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/889433
Signature
Allocates memory in foreign processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 521902 Sample: 05a0f7012de4482c552ffef6972... Startdate: 15/11/2021 Architecture: WINDOWS Score: 100 58 Found malware configuration 2->58 60 Yara detected RedLine Stealer 2->60 62 Machine Learning detection for sample 2->62 64 4 other signatures 2->64 9 05a0f7012de4482c552ffef6972720973144444935728.exe 2->9         started        12 fhelper.exe 2 2->12         started        15 fhelper.exe 2->15         started        process3 dnsIp4 74 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->74 76 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 9->76 78 Writes to foreign memory regions 9->78 80 3 other signatures 9->80 17 AppLaunch.exe 15 7 9->17         started        22 WerFault.exe 23 9 9->22         started        50 blockchain.info 12->50 signatures5 process6 dnsIp7 44 45.142.212.122, 21523, 49742 ALEXHOSTMD Russian Federation 17->44 46 cdn.discordapp.com 162.159.135.233, 443, 49747 CLOUDFLARENETUS United States 17->46 38 C:\Users\user\AppData\Local\...\fhelper.exe, PE32 17->38 dropped 66 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->66 68 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 17->68 70 Tries to harvest and steal browser information (history, passwords, etc) 17->70 72 Tries to steal Crypto Currency Wallets 17->72 24 fhelper.exe 1 6 17->24         started        48 192.168.2.1 unknown unknown 22->48 file8 signatures9 process10 file11 40 C:\Users\user\AppData\Roaming\fhelper.exe, PE32 24->40 dropped 42 C:\Users\user\AppData\...\fhelper.exe.log, ASCII 24->42 dropped 82 Machine Learning detection for dropped file 24->82 28 cmd.exe 1 24->28         started        signatures12 process13 process14 30 fhelper.exe 14 2 28->30         started        34 conhost.exe 28->34         started        36 timeout.exe 1 28->36         started        dnsIp15 52 151.106.1.55, 49814, 49816, 49818 VELIANET-ASvelianetInternetdiensteGmbHDE Germany 30->52 54 blockchain.info 104.16.143.212, 443, 49813, 49828 CLOUDFLARENETUS United States 30->54 56 3 other IPs or domains 30->56 84 Machine Learning detection for dropped file 30->84 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-11-15 12:32:07 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=awqpoajn4recyvjp733jojzas4yuircjgvzif72jan7tmub7x6uq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211115-pqmb4sfabl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
a22e7cbfc26990df80b041e2299f989c881bf572c58d590713ba25ac79b4f396
MD5 hash:
eab67b71794c7c118db546650486ced6
SHA1 hash:
40d13f09025437ba12a24349f10e40415d642b6d
Link:
https://www.unpac.me/results/78b61514-7d65-4744-916e-4087d1df7c5e/
SH256 hash:
05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9
MD5 hash:
e42d69acb75be7780874c9ea58e4aa46
SHA1 hash:
04cb30a014d50db1e5fc438cd17c8b3c97d2c3f6
Link:
https://www.unpac.me/results/78b61514-7d65-4744-916e-4087d1df7c5e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/05a0f7012de4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/205926/
  
URLhaus
https://urlhaus.abuse.ch/url/1791817/
  
Delivery method
Distributed via web download

Comments