MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e988e5af62ae1e0f16d79d8345b9c3923c011c4b3d50020e60ceec507c65b61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e988e5af62ae1e0f16d79d8345b9c3923c011c4b3d50020e60ceec507c65b61
SHA3-384 hash: 788b645dd0eda6bbb117603d2554af261ea716cf49fdb35cfc9fbaed06729fbd366f4fae058163ee2d37c7b65c809c0e
SHA1 hash: 200add7008482531b1e393f3e09a39ff46b89c9d
MD5 hash: a0d5ec8f534f374dceca7f9318a35073
humanhash: november-winter-kentucky-edward
File name:a0d5ec8f534f374dceca7f9318a35073.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'324'544 bytes
First seen:2022-01-20 06:37:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:r8z3fdK+bYxyOB1T1QybjBz09OxXLY2SpQj8/WVNQxR72dvi/IKZ9+T8:uPcdOYLYvZ+/QnbIKZ
Threatray 1'846 similar samples on MalwareBazaar
TLSH T1F15550DD56C51A08CFAF07F14DFBE72E88B296C553136BE9229E50F1272219FB02D4A4
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.253.7.41:49508

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.253.7.41:49508 https://threatfox.abuse.ch/ioc/303332/

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/220872/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47946662.24050.21011.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61e9034f0f8c757253cf73c3/reports/26f6db89-21ee-4a4c-8791-04737c18c5d9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b88cee8d-05fb-476d-97e1-05b436510baf
Result
Threat name:
Clipboard Hijacker RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/924081
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Contains functionality to compare user and computer (likely to detect sandboxes)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 556561 Sample: AQfNLMrf5B.exe Startdate: 20/01/2022 Architecture: WINDOWS Score: 100 59 Found malware configuration 2->59 61 Antivirus detection for URL or domain 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 5 other signatures 2->65 9 AQfNLMrf5B.exe 3 2->9         started        13 oobeldr.exe 2->13         started        process3 file4 39 C:\Users\user\AppData\...\AQfNLMrf5B.exe.log, ASCII 9->39 dropped 81 Writes to foreign memory regions 9->81 83 Injects a PE file into a foreign processes 9->83 15 RegAsm.exe 15 8 9->15         started        85 Antivirus detection for dropped file 13->85 87 Multi AV Scanner detection for dropped file 13->87 89 Found evasive API chain (may stop execution after checking mutex) 13->89 91 Contains functionality to compare user and computer (likely to detect sandboxes) 13->91 20 schtasks.exe 1 13->20         started        signatures5 process6 dnsIp7 45 c9d0e790b353537889bd47a364f5acff43c11f249.xyz 185.112.83.122, 49768, 80 SUPERSERVERSDATACENTERRU Russian Federation 15->45 47 c9d0e790b353537889bd47a364f5acff43c11f248.xyz 15->47 49 5 other IPs or domains 15->49 35 C:\Users\user\AppData\Roaming\e3dwefw.exe, PE32 15->35 dropped 37 C:\Users\user\AppData\Roaming\asf3r3.exe, PE32 15->37 dropped 51 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->51 53 Performs DNS queries to domains with low reputation 15->53 55 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->55 57 Tries to steal Crypto Currency Wallets 15->57 22 asf3r3.exe 3 15->22         started        26 e3dwefw.exe 1 15->26         started        29 conhost.exe 20->29         started        file8 signatures9 process10 dnsIp11 43 185.253.7.41, 49508, 49809 MEDIACONNECTIVEGB Russian Federation 22->43 67 Antivirus detection for dropped file 22->67 69 Multi AV Scanner detection for dropped file 22->69 71 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 22->71 79 4 other signatures 22->79 41 C:\Users\user\AppData\Roaming\...\oobeldr.exe, PE32 26->41 dropped 73 Found evasive API chain (may stop execution after checking mutex) 26->73 75 Uses schtasks.exe or at.exe to add and modify task schedules 26->75 77 Contains functionality to compare user and computer (likely to detect sandboxes) 26->77 31 schtasks.exe 1 26->31         started        file12 signatures13 process14 process15 33 conhost.exe 31->33         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e988e5af62ae1e0f16d79d8345b9c3923c011c4b3d50020e60ceec507c65b61/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-17 15:40:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 43 (62.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2mi4wxwflq6b4lnphmdiw44her4aeoewpkqaihgbtxmkb6glnqq._file
Verdict:
malicious
Similar samples:
016c36da3c46c38f9bc18970acf60b437503e15139fd1047f4b73cdad4d6342a
RedLineStealer
4aab859076a97a23cc10ccc190709d55c7eb1fa95ea15f9c915dbd474887ed2b
RedLineStealer
633a9612349d1981d9ed3714f48054be6b60a13f1370aed7ef92eaf7791e2183
RedLineStealer
672dd4755045abaf5a6f52ab0d4cbdc1f7dec73ed6b575f10e73dfea17f99822
RedLineStealer
7cb8800a28cb750164a44dea0dd7e6379e478f52594999f88203c2ee0d691746
RedLineStealer
932fda59abbce6378d0637c359b61b0747c9602e2e87d3105bb49ad745ed382e
RedLineStealer
ec74416c2898ea04dfcfa12e47492e58b2b1abcf6a927edc6a5a14d9fa17169f
RedLineStealer
+ 1'836 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence spyware stealer
Link:
https://tria.ge/reports/220120-hd24gagdh9/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Sets service image path in registry
Unpacked files
SH256 hash:
0417cda1f91a401b38118b291ca384156984b3a967d0214d902f5564d45569b4
MD5 hash:
841e090c5d8b18b34bc74f3a8341a72c
SHA1 hash:
cf6d0c96829f93a5b500c44eda88cb0b066deb89
Link:
https://www.unpac.me/results/4a01f7d0-404b-4d27-a095-8dd719d4512e/
SH256 hash:
0e988e5af62ae1e0f16d79d8345b9c3923c011c4b3d50020e60ceec507c65b61
MD5 hash:
a0d5ec8f534f374dceca7f9318a35073
SHA1 hash:
200add7008482531b1e393f3e09a39ff46b89c9d
Link:
https://www.unpac.me/results/4a01f7d0-404b-4d27-a095-8dd719d4512e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/0e988e5af62ae1e0f16d79d8345b9c3923c011c4b3d50020e60ceec507c65b61

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/220872/

Comments