MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694
SHA3-384 hash: 456c7661503c27d7cc0596d6dc3c2dbb4780b4df066edc77b2a4ac05373a0b288af9e85dcbd6e340aafb39c9b48e4922
SHA1 hash: d8c87f86c6704a20898b305c5438de9cace94636
MD5 hash: c4699c2bdf286700da2e1b824a02ec8e
humanhash: tango-kilo-nineteen-foxtrot
File name:Order SMG 201906 20190816orderGMD#0498366Deta.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'148'864 bytes
First seen:2024-07-23 06:40:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 23682184df099986ebd41d63cd7803a7 (4 x RemcosRAT, 2 x RedLineStealer, 1 x AgentTesla)
ssdeep 49152:gB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8PDYWg13pb67sca+gpNeB:AaRrFCIcW7dkK
Threatray 2'036 similar samples on MalwareBazaar
TLSH T191A5CE04A3E801A8D47BDB34CA659333D6B0B8460734E58F069DD6492F73EA1AFBB715
TrID 72.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
13.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.EXE) OS/2 Executable (generic) (2029/13)
2.5% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
206.217.128.11:1912

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
206.217.128.11:1912 https://threatfox.abuse.ch/ioc/1303145/

Intelligence

File Origin
# of uploads :
1
# of downloads :
372
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Win.Malware.Dacic-10033090-0
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=669f50842f6eaff4b90f4040
Tags:
Execution Network Static Stealth
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Launching a process
Creating a window
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint hacktool lolbin masquerade microsoft_visual_cc packed regedit remote shell32
Link:
https://www.filescan.io/uploads/669f5084c01cae9c7256bcf5/reports/e691e177-3f00-4a04-acf8-59eebc9d3495/overview
Verdict:
Malicious
Labled as:
Dacic.3448.Generic
Link:
https://www.hybrid-analysis.com/sample/0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b8c918e-15ac-4c10-a27b-c0e4e5ba7ce6
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1478979
Signature
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Drops PE files to the user root directory
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1478979 Sample: Order SMG 201906 20190816or... Startdate: 23/07/2024 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Multi AV Scanner detection for dropped file 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 5 other signatures 2->40 6 Order SMG 201906 20190816orderGMD#0498366Deta.exe 1 3 2->6         started        10 Order SMG 201906 20190816orderGMD#0498366Deta.exe 1 2->10         started        12 Order SMG 201906 20190816orderGMD#0498366Deta.exe 1 2->12         started        process3 file4 28 Order SMG 201906 2...GMD#0498366Deta.exe, PE32+ 6->28 dropped 30 Order SMG 201906 2...exe:Zone.Identifier, ASCII 6->30 dropped 42 Creates autostart registry keys with suspicious names 6->42 44 Writes to foreign memory regions 6->44 46 Allocates memory in foreign processes 6->46 14 CasPol.exe 5 6 6->14         started        18 conhost.exe 6->18         started        48 Injects a PE file into a foreign processes 10->48 20 InstallUtil.exe 5 3 10->20         started        22 conhost.exe 10->22         started        24 AddInProcess32.exe 2 12->24         started        26 conhost.exe 12->26         started        signatures5 process6 dnsIp7 32 206.217.128.11, 1912, 49730, 49731 AS-COLOCROSSINGUS United States 14->32 50 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->50 52 Found many strings related to Crypto-Wallets (likely being stolen) 14->52 54 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->54 56 Tries to harvest and steal browser information (history, passwords, etc) 20->56 58 Tries to steal Crypto Currency Wallets 20->58 signatures8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694/
Threat name:
Win64.Trojan.Stealerc
Create hunting rule
Status:
Malicious
First seen:
2024-07-23 06:41:08 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bpiinckwws4vm632oyh7h7fhuguuhqllpilut6ejflojaiata2ka._file
Verdict:
malicious
Similar samples:
2f05df98b8de8af85942d15c1c7d434ee62be3e3662c551a0e14d29c9531c1cc
RedLineStealer
7306a090c8afd7557dc6a32f072937107058f5d14b5d416730b189647980b757
RedLineStealer
8964c329759b76bef968db9126bf2052f334baaf6e4cbcde52371ffc66b45187
RedLineStealer
8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa
RedLineStealer
9085e6327177bb47cf43a8d8ed0c24fcfd50cde4199c5130f2b97b2508e9aabc
RedLineStealer
b49dbf4ccc6fcc620965e1f38df9f0253c48004b44dd4f7d57f732c057469253
RedLineStealer
c3cff5741919b145dc55c678febd01b98d0f9f491b8384ad0fcbdfe38826bd30
RedLineStealer
+ 2'026 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:foz discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/240723-hfsykstalp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
206.217.128.11:1912
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/57c948e9-a1a3-4770-a59c-351a7d5007dd
Unpacked files
SH256 hash:
0bd0868956b4b9567b7a760ff3fca7a1a943c16b7a1749f8892adc9020130694
MD5 hash:
c4699c2bdf286700da2e1b824a02ec8e
SHA1 hash:
d8c87f86c6704a20898b305c5438de9cace94636
Link:
https://www.unpac.me/results/10fe6450-e705-43ae-ae1b-6a672e1ef76e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0bd0868956b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::CreateWellKnownSid
ADVAPI32.dll::RevertToSelf
ADVAPI32.dll::GetSecurityDescriptorLength
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetWindowsAccountDomainSid
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
ADVAPI32.dll::SetThreadToken
KERNEL32.dll::VirtualAllocExNuma
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::DeleteVolumeMountPointW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FreeConsole
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleWindow
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileExW
KERNEL32.dll::ReplaceFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptDecrypt
bcrypt.dll::BCryptDestroyKey
bcrypt.dll::BCryptEncrypt
bcrypt.dll::BCryptGenRandom
bcrypt.dll::BCryptImportKey
bcrypt.dll::BCryptOpenAlgorithmProvider
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyExW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExA
ADVAPI32.dll::RegSetValueExW

Comments