MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 121f571b0e951c0cb89973c575161970c4c35288a0ed2466043bb40d403720f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 121f571b0e951c0cb89973c575161970c4c35288a0ed2466043bb40d403720f4
SHA3-384 hash: d4c944b25be9e89a7665bafc4fd4c1e64f6c7c0be838ba9a1f721b986bb1ac678b924675ffe893d0f2823d7a9f622888
SHA1 hash: e11c7a438f1d6e4e50cbb73ea8e2ae768adc5122
MD5 hash: bbc519ca26897463a1c3635fb4a4ea66
humanhash: skylark-nitrogen-spring-charlie
File name:bbc519ca26897463a1c3635fb4a4ea66.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'276'072 bytes
First seen:2021-07-12 08:58:08 UTC
Last seen:2021-07-12 09:59:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 24576:4/YoHs3YyAiOYkud9qhEwJCLM9HgksShxO8J96xxmDcJnPFHpiHbbw2ikI0vbZ:4woH4LAiD7dUhEwJCL0jhxOG6EcJnPF6
Threatray 2'548 similar samples on MalwareBazaar
TLSH T1A94533C50E6AC34DD44A4473560FCAE3FB7AC9964E6320BA640E247BBB131D7C69D06E
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
60e94c_EaseUS-Partitio.zip
Verdict:
Malicious activity
Analysis date:
2021-07-10 07:33:07 UTC
Tags:
trojan evasion loader rat redline stealer vidar opendir ficker
Link:
https://app.any.run/tasks/97f667f1-c84e-4462-bae6-db0371006065

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171007/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.959.16217.10100.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/85c95445-2980-47e7-8b24-0a168d7053e6
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814682
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/121f571b0e951c0cb89973c575161970c4c35288a0ed2466043bb40d403720f4/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-07-09 19:10:01 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0c580c106cfd6055e480fb8405575c294729ee0abb0037f5f84e6ae33ad27b69
RedLineStealer
2e5c841497c4beb1aa615b1ae401e099af9e7134f021d67a15700f1e8a18c543
RedLineStealer
42e4233468438e37df608db8eb2590e59bb53f496e3315eddd912adeebccbc51
RedLineStealer
714a30085b93988295ea7b732d24384db7bb3be843e20acd447ae8dd258db7a8
RedLineStealer
c739936172e49a599f88374f7555839c4ad5a11c8dcecc4a0287eb88c633aa3b
RedLineStealer
e6313d65c6dfa85c2aa1f5cfefc0b71ec47d6b9f6f4ef5351fd86b9f6fbbd935
RedLineStealer
edd5a3dc519a5feacea84473ade885844e72b8165a93a91871928330bde659e7
RedLineStealer
f3f540378e07c4686e0d910a8e98285469e360415844f97f0bbbce295c2142b6
RedLineStealer
+ 2'538 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery evasion infostealer spyware stealer themida trojan
Link:
https://tria.ge/reports/210712-s225g6yxla/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
Unpacked files
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/df5fdc1f-b8d9-4fdc-a13d-1b7c538de16b/
SH256 hash:
121f571b0e951c0cb89973c575161970c4c35288a0ed2466043bb40d403720f4
MD5 hash:
bbc519ca26897463a1c3635fb4a4ea66
SHA1 hash:
e11c7a438f1d6e4e50cbb73ea8e2ae768adc5122
Link:
https://www.unpac.me/results/df5fdc1f-b8d9-4fdc-a13d-1b7c538de16b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/121f571b0e951c0cb89973c575161970c4c35288a0ed2466043bb40d403720f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_mem
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8/
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 121f571b0e951c0cb89973c575161970c4c35288a0ed2466043bb40d403720f4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1424943/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171007/

Comments