MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c
SHA3-384 hash: 1968b986093a011cee62d1b41197535ba573719190952e7802d4acd9c26125720e00903432ca1f0a909e1afaac89e7bd
SHA1 hash: d0065781ab0b9ef94e79cd6b8b24c6ac693d3e09
MD5 hash: 43ef0684e801e0157975db9a1fba57b8
humanhash: single-oxygen-summer-south
File name:setup.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'509'888 bytes
First seen:2021-12-05 22:38:06 UTC
Last seen:2021-12-06 00:56:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d7dd6fa75115d9909f747434e40fff68 (173 x RedLineStealer, 10 x DCRat, 1 x CoinMiner.XMRig)
ssdeep 24576:J2cuceEbCDs36OOgw4tqwXaETDLJYm4WVT/9yQ4vfbBCfZDpN3kEaHNYK3nEB:4cVbCDszDwIq/gDLJYux/9y7bURpN3NL
Threatray 9'254 similar samples on MalwareBazaar
TLSH T1AA65338955086F0ED61E97B0AC1737D1C02C4B16E7F12A3E746B1E8F4B1C9A8DE7C266
Reporter JaffaCakes118
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup.exe
Verdict:
Malicious activity
Analysis date:
2021-12-05 22:37:59 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/9702ab06-040f-414e-b414-1c1c8270dd94

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/211529/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Sending a TCP request to an infection source
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/959/overview
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed wacatac
Link:
https://www.filescan.io/uploads/61ad3f88fa72c81b5b0d5e80/reports/e00bbba6-d4b8-471a-a976-11d01a6c522c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dd3c1eee-a266-414e-a045-d5e1d749b7c2
Result
Threat name:
BitCoin Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/901833
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Conti Backup Database
Sigma detected: Disable or Delete Windows Eventlog
Sigma detected: Powershell Defender Exclusion
Sigma detected: PowerShell SAM Copy
Sigma detected: Suspicious PowerShell Invocations - Generic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 534311 Sample: setup.exe Startdate: 05/12/2021 Architecture: WINDOWS Score: 100 78 Found malware configuration 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 Yara detected BitCoin Miner 2->82 84 10 other signatures 2->84 10 setup.exe 15 7 2->10         started        15 services32.exe 2 2->15         started        process3 dnsIp4 74 185.215.113.205, 49747, 65531 WHOLESALECONNECTIONSNL Portugal 10->74 76 cdn.discordapp.com 162.159.134.233, 443, 49750 CLOUDFLARENETUS United States 10->76 68 C:\Users\user\AppData\Local\Temp\fl.exe, PE32+ 10->68 dropped 70 C:\Users\user\AppData\Local\...\setup.exe.log, ASCII 10->70 dropped 112 Detected unpacking (changes PE section rights) 10->112 114 Detected unpacking (overwrites its own PE header) 10->114 116 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->116 126 5 other signatures 10->126 17 fl.exe 4 10->17         started        118 Antivirus detection for dropped file 15->118 120 Multi AV Scanner detection for dropped file 15->120 122 Machine Learning detection for dropped file 15->122 124 Adds a directory exclusion to Windows Defender 15->124 21 cmd.exe 15->21         started        file5 signatures6 process7 file8 64 C:\Windows\System32\services32.exe, PE32+ 17->64 dropped 86 Antivirus detection for dropped file 17->86 88 Multi AV Scanner detection for dropped file 17->88 90 Machine Learning detection for dropped file 17->90 23 cmd.exe 17->23         started        26 cmd.exe 1 17->26         started        28 cmd.exe 1 17->28         started        92 Adds a directory exclusion to Windows Defender 21->92 30 conhost.exe 21->30         started        32 powershell.exe 21->32         started        34 powershell.exe 21->34         started        signatures9 process10 signatures11 106 Drops executables to the windows directory (C:\Windows) and starts them 23->106 36 services32.exe 23->36         started        41 conhost.exe 23->41         started        108 Uses schtasks.exe or at.exe to add and modify task schedules 26->108 110 Adds a directory exclusion to Windows Defender 26->110 43 powershell.exe 22 26->43         started        45 conhost.exe 26->45         started        47 powershell.exe 26->47         started        49 conhost.exe 28->49         started        51 schtasks.exe 1 28->51         started        process12 dnsIp13 72 192.168.2.1 unknown unknown 36->72 66 C:\Windows\System32\...\sihost32.exe, PE32+ 36->66 dropped 102 Drops executables to the windows directory (C:\Windows) and starts them 36->102 104 Adds a directory exclusion to Windows Defender 36->104 53 sihost32.exe 36->53         started        56 cmd.exe 36->56         started        file14 signatures15 process16 signatures17 94 Antivirus detection for dropped file 53->94 96 Multi AV Scanner detection for dropped file 53->96 98 Machine Learning detection for dropped file 53->98 100 Adds a directory exclusion to Windows Defender 56->100 58 conhost.exe 56->58         started        60 powershell.exe 56->60         started        62 powershell.exe 56->62         started        process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c/
Threat name:
Win32.Trojan.RedLineSteal
Create hunting rule
Status:
Malicious
First seen:
2021-12-05 22:39:15 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckxm7zy44u3j3e2ldy4zjzm7xnqmyg2cw75prfrf2qyvave3zroa._file
Verdict:
malicious
Similar samples:
021aed248cfbe2b30f4ab53d7ec95ab8ce1a176d5d92d8c7cd03a39590683574
RedLineStealer
0575a7431f07b940e6757d2cffbf1ec4fba829f173fc95a4df953a9ef10994c4
RedLineStealer
086adff5d4c7d463878ca94751dc2f51e4e9d8f0814d59fa502f6a5c3b7be659
RedLineStealer
29c409e07f6bff407c11023eae2d2bb2a9033e44fbb4a07897a785f5ae1c3d24
RedLineStealer
39f8595624535025d6a99bfe5e8619ee4ba1d5bc635d0432cebc885eac61b3ff
RedLineStealer
9b5ed328b480c04906ccd41ce1a536cfa5607e51acf66fb21910b1859eb0a73f
RedLineStealer
a2a016786b8fe135450ba0580450df69d6c6a859f8ed980138db8d8c3fede92a
RedLineStealer
af56a24c3af012c1ce963d7f752185e1cf079a972ea58c6c4c334b69e0324a37
RedLineStealer
dd404b5d3eff0840ba192d8b5c5a25a475feee2f73b069799bffd38ec43edb0c
RedLineStealer
+ 9'244 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery evasion infostealer spyware stealer trojan vmprotect
Link:
https://tria.ge/reports/211205-2kyjeadacj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
RedLine Payload
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/fddf7398-cbcd-43d7-8e95-25051797469b/
SH256 hash:
12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c
MD5 hash:
43ef0684e801e0157975db9a1fba57b8
SHA1 hash:
d0065781ab0b9ef94e79cd6b8b24c6ac693d3e09
Link:
https://www.unpac.me/results/fddf7398-cbcd-43d7-8e95-25051797469b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/12aecfe71ce5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 12aecfe71ce5369d934b1e3994e59fbb60cc1b42b7faf89625d43150549bcc5c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/211529/

Comments