MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1237f60be32fedd4729cc33b077a902382c15c495327cfa55650ca66642506d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1237f60be32fedd4729cc33b077a902382c15c495327cfa55650ca66642506d1
SHA3-384 hash: 6d83b501ddc10e15256d642b50ff30c0f241d840974b567533887da4021970d658f5695a64d61b4df213a868ac838381
SHA1 hash: c28d0df1c3ddd3a56b8d13e646ab94f96fcf2394
MD5 hash: a4dfb4fa799f2b12cf58b18412e29d85
humanhash: crazy-table-fix-eighteen
File name:a4dfb4fa799f2b12cf58b18412e29d85.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:532'480 bytes
First seen:2021-12-22 00:05:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f6af73011d9ad7cbccf66eb190442910 (42 x RedLineStealer, 8 x RaccoonStealer, 1 x Smoke Loader)
ssdeep 12288:4eXTiNYKchww9tfRCz6QS03ULaHNqrxlKIQNoqgl8kJ2lay3z8d:tOKKchFDfRPkEaHNYK3vkJ1/
Threatray 592 similar samples on MalwareBazaar
TLSH T177B4222BAE94675CCD0917BC429FED3AC2ABD5314C44D3B1300A1744726B61BE27FA6E
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
5.206.227.27:65531

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.206.227.27:65531 https://threatfox.abuse.ch/ioc/279899/

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ThetanArena_Immortal.rar
Verdict:
Malicious activity
Analysis date:
2021-12-21 13:29:09 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/f6979c82-fa9f-4c26-809b-eb7bd7ee758c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215717/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Malware.Generickdz-9908211-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Searching for the window
DNS request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2900/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61c26bed8991ba72b39103ca/reports/f40ff57c-8b1c-4f01-ba0f-8dda373abfe5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38ee47b8-41c7-4038-bff8-7edeed2784f9
Result
Threat name:
BitCoin Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/911291
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Detected VMProtect packer
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 543769 Sample: 1ynFvXrvup.exe Startdate: 22/12/2021 Architecture: WINDOWS Score: 100 86 Found malware configuration 2->86 88 Multi AV Scanner detection for submitted file 2->88 90 Yara detected BitCoin Miner 2->90 92 6 other signatures 2->92 11 1ynFvXrvup.exe 2->11         started        14 services32.exe 2->14         started        process3 signatures4 110 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 11->110 112 Writes to foreign memory regions 11->112 114 Allocates memory in foreign processes 11->114 116 Injects a PE file into a foreign processes 11->116 16 AppLaunch.exe 15 7 11->16         started        21 WerFault.exe 23 9 11->21         started        118 Antivirus detection for dropped file 14->118 120 Multi AV Scanner detection for dropped file 14->120 122 Machine Learning detection for dropped file 14->122 124 Adds a directory exclusion to Windows Defender 14->124 23 cmd.exe 14->23         started        25 sihost32.exe 14->25         started        process5 dnsIp6 80 5.206.227.27, 49745, 65531 DOTSIPT Portugal 16->80 82 dl.uploadgram.me 176.9.247.226, 443, 49750 HETZNER-ASDE Germany 16->82 72 C:\Users\user\AppData\Local\Temp\fl.exe, PE32+ 16->72 dropped 94 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->94 96 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->96 98 Tries to harvest and steal browser information (history, passwords, etc) 16->98 100 Tries to steal Crypto Currency Wallets 16->100 27 fl.exe 4 16->27         started        74 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 21->74 dropped 102 Adds a directory exclusion to Windows Defender 23->102 32 conhost.exe 23->32         started        34 powershell.exe 23->34         started        36 powershell.exe 23->36         started        file7 signatures8 process9 dnsIp10 84 192.168.2.1 unknown unknown 27->84 76 C:\Windows\System32\services32.exe, PE32+ 27->76 dropped 126 Antivirus detection for dropped file 27->126 128 Multi AV Scanner detection for dropped file 27->128 130 Machine Learning detection for dropped file 27->130 132 Adds a directory exclusion to Windows Defender 27->132 38 cmd.exe 27->38         started        41 cmd.exe 1 27->41         started        43 cmd.exe 27->43         started        file11 signatures12 process13 signatures14 104 Drops executables to the windows directory (C:\Windows) and starts them 38->104 45 services32.exe 38->45         started        49 conhost.exe 38->49         started        106 Uses schtasks.exe or at.exe to add and modify task schedules 41->106 108 Adds a directory exclusion to Windows Defender 41->108 51 powershell.exe 21 41->51         started        53 conhost.exe 41->53         started        55 powershell.exe 41->55         started        57 conhost.exe 43->57         started        59 schtasks.exe 43->59         started        process15 file16 78 C:\Windows\System32\...\sihost32.exe, PE32+ 45->78 dropped 142 Drops executables to the windows directory (C:\Windows) and starts them 45->142 144 Adds a directory exclusion to Windows Defender 45->144 61 sihost32.exe 45->61         started        64 cmd.exe 45->64         started        signatures17 process18 signatures19 134 Antivirus detection for dropped file 61->134 136 Multi AV Scanner detection for dropped file 61->136 138 Machine Learning detection for dropped file 61->138 140 Adds a directory exclusion to Windows Defender 64->140 66 conhost.exe 64->66         started        68 powershell.exe 64->68         started        70 powershell.exe 64->70         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1237f60be32fedd4729cc33b077a902382c15c495327cfa55650ca66642506d1/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 02:56:15 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ci37mc7df7w5i4u4ym5qo6uqeobmcxcjkmt47jkwkdfgmzbfa3iq._file
Verdict:
malicious
Similar samples:
4970975b3596048497e4cd865a66e68b017afddc392ce8de6d1b071846908295
RedLineStealer
5617cf97967fc9377f8b775f52fe43c8c54f9cab67fa164f6f903d4ebe9b79c2
RedLineStealer
64edbaff99fe8c87c2f5f826b0d1741c575295e3ab0c3d16db8bbacd2baebd30
RedLineStealer
7aa0ca4f6c99c7e5e5f3893118d5a6ec7a572c710d8055cfb35754595b83e588
RedLineStealer
977c68b28f92df1f9cb32d67323dc5c13ee2da192f8007dbf893338529bd88e2
RedLineStealer
a3c94c395d04cfbf184c51d01a196ca35f373b5874743f09ea28ebbb775bac01
RedLineStealer
aea2cbc32b7925ab28e619b8deb5c540ea8e61ad631b02e348be04b87f44627a
RedLineStealer
cf48264ec1ae636f92543b873e455d9c56a8c1f274746caa6357aaccf1b42096
RedLineStealer
e237102ecce153410e4609db0ec5986e2d874a5efe4c9ace10bd419e80dce974
RedLineStealer
ff96c1b6af7f067e0ffe1d90c7d91dd39ac01f22ebb7868eb54f2d414951a728
RedLineStealer
+ 582 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211222-adr99segd4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
63b4e718bde5dec2b43a2fa34e6c1ecececeb55f25b94dc484d64f70c8245f23
MD5 hash:
c596bb643dc68596ecba6621284cccca
SHA1 hash:
30701401460b52222eceb342211f337b288fc082
Link:
https://www.unpac.me/results/d4653bf1-eeb6-44a9-a9fe-dcdf18f5ea7f/
SH256 hash:
1237f60be32fedd4729cc33b077a902382c15c495327cfa55650ca66642506d1
MD5 hash:
a4dfb4fa799f2b12cf58b18412e29d85
SHA1 hash:
c28d0df1c3ddd3a56b8d13e646ab94f96fcf2394
Link:
https://www.unpac.me/results/d4653bf1-eeb6-44a9-a9fe-dcdf18f5ea7f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1237f60be32fedd4729cc33b077a902382c15c495327cfa55650ca66642506d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/215717/

Comments