MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 144750d91bdca21697d15f3dd12845497d62715c6c7251b033d039802795cbda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 144750d91bdca21697d15f3dd12845497d62715c6c7251b033d039802795cbda
SHA3-384 hash: ab64fdb14127488db8da97b216ed42fdfe5e1917d4bc3d347f578c451520ef137250017aca43bb8df381000ee7217be8
SHA1 hash: 1fc145a74a5675d08d752b69aa1d256edff84a05
MD5 hash: 4a892ee8c7acf62b55d2b38f90423dfc
humanhash: oven-speaker-sodium-wolfram
File name:IMG_0100242444.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'010'504 bytes
First seen:2022-10-12 12:59:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (385 x GuLoader, 58 x RemcosRAT, 40 x AgentTesla)
ssdeep 24576:6jQchlraowtRLdNS4Z8U4I3omKwep0xkMSW3+Wt6CT5:Cn5aT7S4vdCukMeY6e
Threatray 1'295 similar samples on MalwareBazaar
TLSH T14E2523B073A1C212DA12CB70E53A7239CEF98E5444A194C737D975317D34BAC8E9E26E
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 81b9dada86cd31c5 (1 x GuLoader, 1 x RedLineStealer)
Reporter GovCERT_CH
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-08-06T04:54:22Z
Valid to:2025-08-05T04:54:22Z
Serial number: 322fc5715778edfc
Thumbprint Algorithm:SHA256
Thumbprint: a7f0b33d43e99db10f2ec17ac0a2846812e63ed68f5f1a9a1947d36d0b5a634a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/319360/
Detection(s):
SecuriteInfo.com.Win32.SuspectCrc.28959.31984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the Windows subdirectories
Creating a file
Delayed reading of the file
Creating a file in the Program Files subdirectories
Creating a file in the %temp% subdirectories
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42670/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
guloader overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6346ba56aab5b3e31a6abf4e/reports/ee9e10a4-6430-4865-9d1b-770451b97c34/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3f860f17-5305-453e-827a-1e6288befd8d
Result
Threat name:
GuLoader, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1088801
Signature
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Mass process execution to delay analysis
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected GuLoader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 721400 Sample: IMG_0100242444.exe Startdate: 12/10/2022 Architecture: WINDOWS Score: 100 42 api.ip.sb 2->42 44 movbihf.tk 2->44 50 Snort IDS alert for network traffic 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 7 other signatures 2->56 8 IMG_0100242444.exe 14 73 2->8         started        signatures3 process4 file5 34 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->34 dropped 36 C:\Users\user\AppData\Local\...\System.dll, PE32 8->36 dropped 38 C:\Users\user\AppData\...\libpng16-16.dll, PE32+ 8->38 dropped 40 4 other files (none is malicious) 8->40 dropped 58 Writes to foreign memory regions 8->58 60 Mass process execution to delay analysis 8->60 62 Tries to detect Any.run 8->62 12 CasPol.exe 8->12         started        16 CasPol.exe 8->16         started        18 powershell.exe 8->18         started        20 72 other processes 8->20 signatures6 process7 dnsIp8 46 109.248.144.161, 16114, 49806, 49809 DATACLUB-SE Russian Federation 12->46 48 movbihf.tk 132.148.73.81, 443, 49805 AS-26496-GO-DADDY-COM-LLCUS United States 12->48 64 Tries to harvest and steal browser information (history, passwords, etc) 12->64 66 Tries to detect Any.run 12->66 68 Tries to steal Crypto Currency Wallets 12->68 22 conhost.exe 12->22         started        70 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->70 72 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->72 24 conhost.exe 18->24         started        26 conhost.exe 20->26         started        28 conhost.exe 20->28         started        30 conhost.exe 20->30         started        32 69 other processes 20->32 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/144750d91bdca21697d15f3dd12845497d62715c6c7251b033d039802795cbda/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-10 22:05:57 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
14 of 42 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=crdvbwi33srbnf6rl465ckcfjf6we4k4nrzfdmbt2a4yaj4vzpna._file
Verdict:
malicious
Similar samples:
0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3
RedLineStealer
275db34b1b3d894ed18fba50f477ca897bb3656682c7d0ef2941bd7c696e9f80
RedLineStealer
595f2ae803f01eba157b6deff4687380346e15609e43cc05b541b527bb7292eb
RedLineStealer
7132f9426f3bbadaedd15c39968640ffc5ad207b3c8f450d642174e2942f09d7
RedLineStealer
7d99aa5b81da99461aa61d5542cabce7bc5ffedc56cd1c1d9d6e58e242b38802
RedLineStealer
a18ab93f8c9268841b6cd59842a935651d9267fa2b8f72b2196cf68f7b57df9d
RedLineStealer
a9acac2bc60cd65b24257dcd59cba1f79a5d8ebe6b68cffef12968038acd2675
RedLineStealer
e5653285dfebc9a95f3a866693752e3f0e62ae312aaf054249067e22cf5836a5
RedLineStealer
f46d8267eb7fe636d2c5183100bc97e4a93b3a21c5d15661a3dc49ae891f621d
RedLineStealer
+ 1'285 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:redline botnet:money discovery downloader infostealer spyware
Link:
https://tria.ge/reports/221012-p8nmwsdefn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks QEMU agent file
Loads dropped DLL
Guloader,Cloudeye
RedLine
RedLine payload
Malware Config
C2 Extraction:
109.248.144.161:16114
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a116451e-1ea7-478d-b6c8-a35df03943dc
Unpacked files
SH256 hash:
80b76b73d2d143b5db4e2d2e24438a68647ae96ac37289415c1caef5c2ed63d3
MD5 hash:
1b76bca7bef0f515d39f31e3c084f31d
SHA1 hash:
92705562f13db5967e66624286f8291477b7b217
Link:
https://www.unpac.me/results/272d7e1a-e4bb-4cd1-9ecb-a112fc007162/
SH256 hash:
9d1849425597da7e314adb3d6300f6a6cf70aecebdd36276120a4f399a0ca14c
MD5 hash:
e89c979ddf75a064ea3cd8d5cca760f7
SHA1 hash:
a6774daf7206644c96411186b09639e5426f0513
Link:
https://www.unpac.me/results/272d7e1a-e4bb-4cd1-9ecb-a112fc007162/
SH256 hash:
144750d91bdca21697d15f3dd12845497d62715c6c7251b033d039802795cbda
MD5 hash:
4a892ee8c7acf62b55d2b38f90423dfc
SHA1 hash:
1fc145a74a5675d08d752b69aa1d256edff84a05
Link:
https://www.unpac.me/results/272d7e1a-e4bb-4cd1-9ecb-a112fc007162/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.73
Link:
https://yomi.yoroi.company/submissions/144750d91bdca21697d15f3dd12845497d62715c6c7251b033d039802795cbda

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

Executable exe 144750d91bdca21697d15f3dd12845497d62715c6c7251b033d039802795cbda

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/319360/

Comments