MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 12 File information Comments

SHA256 hash:	10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21
SHA3-384 hash:	01cbb01c4b89130fd4b361dc34c84846cb57182c508fc3928f40f961b608c4327f90845d222bd5d6e3b94789bfc8f8e3
SHA1 hash:	78760adf649c3b42fe95b63d58d9d80e1a5593b9
MD5 hash:	382045af03eb417e3f0c0d23e46ce46f
humanhash:	jupiter-orange-kitten-cat
File name:	file
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	455'032 bytes
First seen:	2023-10-08 14:24:19 UTC
Last seen:	2023-10-09 04:35:07 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f5f86efbd827b8a05e7f7115d12623f0 (2 x RedLineStealer, 2 x PovertyStealer)
ssdeep	6144:b/aiGs0V5vbjGibWeHGTTmO4AOJfmIqd+xuuT0YxehH/X/lgkSKpyVUXS:bCiGs0VpBEm5eIvxuuT0Yw6krpUUXS
Threatray	355 similar samples on MalwareBazaar
TLSH	T1C4A45B0D69A2C823D2551E3250D697A2CB7B7C795A246C6FDF4C477ECA60370AB2CD23
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	andretavare5
Tags:	exe RedLineStealer

andretavare5

Sample downloaded from http://194.169.175.232/autorun.exe

Intelligence

File Origin

# of uploads :

# of downloads :

316

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.FileRepMalware.27172.22677.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Launching the default Windows debugger (dwwin.exe)

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control greyware lolbin overlay packed

Link:

https://www.filescan.io/uploads/6522bbc140343f27c674b9ba/reports/9b630b96-9b7e-40a6-8acf-c7f70c57d6a5/overview

Verdict:

Malicious

Labled as:

Trojan.RP.BqY@bOX.Generic

Link:

https://www.hybrid-analysis.com/sample/10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4452709f-2ece-4512-b3e8-dd3014ca0288

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1321753

Signature

.NET source code contains very large array initializations

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21/

Threat name:

Win32.Trojan.Whispergate

Status:

Malicious

First seen:

2023-10-08 14:25:07 UTC

File Type:

PE (Exe)

AV detection:

17 of 22 (77.27%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ccaw2mm6svt46n2afdvr4uikkrm6v52x3ervrqwbd43lyiyynuqq._file

Verdict:

malicious

RedLineStealer

4d09119d9a264e45ac8e6931738eb79f52b44f217dbc10ed72056cbbcac2d836

RedLineStealer

545dfa973a3c7308627b21d1c230d58323bf08fdf8e0a31fdf4efaefd5f2fa12

RedLineStealer

58448c417657e36527847d43cb0adc5e910b8e5211cbf8b3fc35c52b59332c53

RedLineStealer

5aecfd145020845cb448e25cc896ce62b5359c01d1ebd68cfedb7385374a9cef

RedLineStealer

70655332d3dbe7662fd0f0035989cba7aae059b53df195c92d5234c01ead643d

RedLineStealer

adad848bf6d7a20eb9faef8413be0071b82fc7b237c867e15e05e7d5600d23ee

RedLineStealer

e6e34973f51bfecb0dea2825753f1db7414549d9e794bcdf8191b1d8486ffcf9

RedLineStealer

eadfa96ccc8310d66e17163dca4825b97b5ca5d510faf53449a85caafdc66809

RedLineStealer

fd42fff03752fe763d0e90f0c164ad376edaf3c24b7bc872c70ecf236ebf9f10

RedLineStealer

+ 345 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:smokiez285 infostealer spyware

Link:

https://tria.ge/reports/231008-rrae2sch5t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

RedLine payload

Malware Config

C2 Extraction:

194.169.175.232:45451

Unpacked files

SH256 hash:

2badafa867fda2f72ddb7a8491dc64f8a0757ff07d4f512edda5900d3be74d65

MD5 hash:

6583555afa403cca26d68c3a9386fd68

SHA1 hash:

c071a264674ccc87fd4b865e9164f6b0eac62d9a

Detections:

redline

Link:

https://www.unpac.me/results/a188d31c-d938-44dc-b592-61593096e797/

Parent samples :

be8ec715501cffc350a70f6152f1244907091af202e574b38c4b8e9077e2d7e8
ea12961ab4496771ad1f6056a294a335d60661a725e98f7a443cc45e4826860c
63a2e4ff605edbe78b72027f63b1ee37f76dd48c1a216e4f42a819cab7b57179
40a90e628cc075526434cf155a464239f8f6a6dc9157788dee5b5209943ab67f
9cc458ba7d97a5db07e7a42561b0d55e4adfce7e41a4a477b06e3b0fd5e871bf
d78ba749c5162b591ec8b2e8e70fc758bd545f86c05b05c47d4d0388833bd498
c13ef6f741861e02f505fcd7dd8e5f770c5e0b70167e65c6fa14b59067a3e2cb
d3595d8ed1b9f2ec77f0c654fe92e8397ffbd9cae6615f87f68fd0442d6229cc
34827a66a28b9fad1b1f0daeb1f4d15185942df647207305d94f00e6be2a689e
4f90d97f3ef33851bba630cb781820f861144c97b7b962363ba18ee9bd72a7c2
53a93577991f5ff457ce602fbdb133754cdbb3b3d73300aeacb5640819a1920b
71580dae1707ba6cf9590f966cb9f3af646f413c2f418de864da8f2148b76b25
7facbc0f3f99b780c838a040234fc2e1315bd3d3acadc0ee0226eb890e891605
10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21
97d9696f980554aa1ac89abae70e947e83875a399f346026722e01c3bfc685e6
ffbd6ffb75e77b342f3caa7729254ef5dc198c783a78310d74923fd86ce4614e

SH256 hash:

10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21

MD5 hash:

382045af03eb417e3f0c0d23e46ce46f

SHA1 hash:

78760adf649c3b42fe95b63d58d9d80e1a5593b9

Link:

https://www.unpac.me/results/a188d31c-d938-44dc-b592-61593096e797/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/10816d319e95/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Redline

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Dropped by

PrivateLoader

Delivery method

Distributed via drive-by

URLhaus

https://urlhaus.abuse.ch/url/2706937/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample