MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b251371b4891fe08157e6b9c84e0267a8c6d33cad2b2a06702c8f2f62381bda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b251371b4891fe08157e6b9c84e0267a8c6d33cad2b2a06702c8f2f62381bda
SHA3-384 hash: 548a52d27f8618dd82c6b3cff808c39901156bd8fb68d5e3b9c2405cb5de96daa177c4322c6bd6655425a4b403ac41df
SHA1 hash: ce0c2ca3900c47cc15527b4da6ee867cea454129
MD5 hash: 76b4104c47743ef2ca274a09de5fbf3c
humanhash: missouri-jig-comet-island
File name:@NorthBearStation-31048357-1123-4cc7-a673-dd6a65322720.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:345'032 bytes
First seen:2022-05-18 18:39:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 55be0c93c66ed8138f777cda7ce3ebbb (8 x RedLineStealer)
ssdeep 6144:lts43MehbflUNHThahCLQTidsZr1AOIdFg06NuirP66FwM5Sef:l9MehbflUNYlZGS0Yz5Se
Threatray 99 similar samples on MalwareBazaar
TLSH T1B574BF417493C031E97115304CF5DAB79E3EBD200E345DAF6B941B6B4E323D2EA72AA6
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter nyyuzyou
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
@NorthBearStation-31048357-1123-4cc7-a673-dd6a65322720.exe
Verdict:
Malicious activity
Analysis date:
2022-05-18 18:44:23 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/002ee013-2d85-4200-bdab-329b06bdfaf6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/272218/
Detection(s):
Win.Packed.Crypterx-9940465-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/18801/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/62853d54d06ea2f4a07559d1/reports/009815b7-ef7f-4bb4-81ec-a4e1ab838a36/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80faadb0-bdbf-4e2e-8828-1263bb1f71a1
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/997095
Signature
Allocates memory in foreign processes
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 629590 Sample: @NorthBearStation-31048357-... Startdate: 18/05/2022 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 6 other signatures 2->42 9 @NorthBearStation-31048357-1123-4cc7-a673-dd6a65322720.exe 1 2->9         started        process3 signatures4 48 Writes to foreign memory regions 9->48 50 Allocates memory in foreign processes 9->50 52 Injects a PE file into a foreign processes 9->52 12 AppLaunch.exe 15 7 9->12         started        17 conhost.exe 9->17         started        process5 dnsIp6 30 62.204.41.141, 24758, 49746 TNNET-ASTNNetOyMainnetworkFI United Kingdom 12->30 32 siasky.net 185.130.226.99, 443, 49754 HOSTKEY-ASNL Netherlands 12->32 34 192.168.2.1 unknown unknown 12->34 28 C:\Users\user\AppData\Local\Temp\start.exe, PE32+ 12->28 dropped 54 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->54 56 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 12->56 58 Tries to harvest and steal browser information (history, passwords, etc) 12->58 60 Tries to steal Crypto Currency Wallets 12->60 19 start.exe 12->19         started        file7 signatures8 process9 signatures10 44 Multi AV Scanner detection for dropped file 19->44 46 Tries to harvest and steal browser information (history, passwords, etc) 19->46 22 cmd.exe 1 19->22         started        process11 process12 24 conhost.exe 22->24         started        26 choice.exe 1 22->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b251371b4891fe08157e6b9c84e0267a8c6d33cad2b2a06702c8f2f62381bda/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2022-05-18 18:40:07 UTC
File Type:
PE (Exe)
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bmsrg4nurep6bakx4244qtqcm6umnuz4vuvsubtqfshs6yrydpna._file
Verdict:
malicious
Similar samples:
1b6db2ff76f4564310210b20e13118f37c92e1ef46541b1aec6b5a98be598ae4
RedLineStealer
27e097f778ff901a6ab3ec22ab871e5185328dd9243654087fa52926337d012f
RedLineStealer
3d65c7d952d9799825669302c0aa7a9c621796acfe0c29c46ba2d74cb8fb9dcd
RedLineStealer
44da6217702a77c01ed9735e67d6fffee11de2298aaaea899ddbc39da26460e0
RedLineStealer
4cbe62ea4c09d6e5ff8141917c8caa78029e64b27475332b8dd372f0a989d981
RedLineStealer
7d9e22e88f7b5abf22553dfc438d8f40e17c33e8fc9fb0141f25eaaba8ebca6e
RedLineStealer
8101c71c2c31df8da09ed7dd55da9bbd949b028f8f54f0e1cbffab82b192ed87
RedLineStealer
afac7896cf21983233c533eeaec870610856969d98218b0ffdfa11c6f57a8420
RedLineStealer
bec113f52e725b1e43720bb9ab1faece1043fc4562f1de3c3d43c1cfc97f2ada
RedLineStealer
e69716b0ea13b412bf6e3ac4f9a0bca987d99788f9d20cedd8fcacee0a7c3f38
RedLineStealer
+ 89 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware stealer upx
Link:
https://tria.ge/reports/220518-xa61ksfeaj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
RedLine
RedLine Payload
Malware Config
C2 Extraction:
62.204.41.141:24758
Unpacked files
SH256 hash:
3661f2d34b5ecc0b9451c2f5ff86ca431d64be6e1d7d73529ea1aa825ddb0626
MD5 hash:
75ec1bcda67db499fa473129bba47ce5
SHA1 hash:
a551abfb55d5a3715b6b5d151255d8331df81e24
Link:
https://www.unpac.me/results/bdf6cfa1-1d5c-404a-915d-5c3ac1714296/
SH256 hash:
0b251371b4891fe08157e6b9c84e0267a8c6d33cad2b2a06702c8f2f62381bda
MD5 hash:
76b4104c47743ef2ca274a09de5fbf3c
SHA1 hash:
ce0c2ca3900c47cc15527b4da6ee867cea454129
Link:
https://www.unpac.me/results/bdf6cfa1-1d5c-404a-915d-5c3ac1714296/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0b251371b489/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b251371b4891fe08157e6b9c84e0267a8c6d33cad2b2a06702c8f2f62381bda

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/272218/

Comments