MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 148e0e3a32f4e4fa38f170fcf8543177ec8aef1ab75d79821446482618e00b1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 148e0e3a32f4e4fa38f170fcf8543177ec8aef1ab75d79821446482618e00b1b
SHA3-384 hash: 1ee10448fda06ce58b9ffd8b49f23eb6c9324a2f20f4ddf5887ebe3ef4761e6f763f346da9980330f19e74224212df6a
SHA1 hash: 7994fcb9cb806fbb6a3cd6b6aee4b8c190fbc6d2
MD5 hash: 8306b5641914d5ecb3c256be8092a391
humanhash: lamp-pip-mango-steak
File name:AutoInstall.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:313'512 bytes
First seen:2022-05-22 07:18:42 UTC
Last seen:2022-05-22 07:30:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c0a7a754d40b7f09b8630c74b76d69f5 (1 x RedLineStealer)
ssdeep 6144:VVkfvhUK34OyHNNx0bxBNIaMeDNAOoVDesyocTzEGmW:4fvhUK34fOR6AsyoaEzW
Threatray 5'177 similar samples on MalwareBazaar
TLSH T190649D1038899035E43314F64EFCC7B8AA3977B14B5659FB5BC40B6E0FB01D16B38A5A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter ShinigamiOwl
Tags:exe RedLineStealer


Avatar
ShinigamiOwl
https://www.mediafire.com/file/jnm963vfjxlb4nr/release_1.11.rar/file

https://mega.nz/file/lNlh2bTB#8K3vTqabDhhZFDes5IXCCYZafNfo6S0WXc8tyfsHDkk

Intelligence

File Origin
# of uploads :
2
# of downloads :
336
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
AutoInstall.exe
Verdict:
Malicious activity
Analysis date:
2022-05-22 07:19:27 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/24f7a11c-99ea-4125-a5c3-49e60a8b060c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/273391/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a TCP request to an infection source
Query of malicious DNS domain
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/19503/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
babar control.exe greyware overlay packed redline wacatac
Link:
https://www.filescan.io/uploads/6289e4246eb3ff32631df92b/reports/582b75cd-c2bf-4846-9c34-ca814953445c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/251c8892-8811-4fd2-804d-afc453b61d56
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/999267
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Redline Clipper
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 631763 Sample: AutoInstall.exe Startdate: 22/05/2022 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic 2->33 35 Found malware configuration 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 5 other signatures 2->39 8 AutoInstall.exe 2 2->8         started        process3 signatures4 49 Contains functionality to inject code into remote processes 8->49 51 Writes to foreign memory regions 8->51 53 Allocates memory in foreign processes 8->53 55 Injects a PE file into a foreign processes 8->55 11 RegSvcs.exe 15 7 8->11         started        16 conhost.exe 8->16         started        process5 dnsIp6 27 104.168.44.52, 49741, 80 AS-COLOCROSSINGUS United States 11->27 29 cdn.discordapp.com 162.159.133.233, 443, 49747 CLOUDFLARENETUS United States 11->29 31 2 other IPs or domains 11->31 25 C:\Users\user\AppData\Local\Temp\debug.exe, PE32 11->25 dropped 57 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->57 59 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->59 61 Tries to harvest and steal browser information (history, passwords, etc) 11->61 63 Tries to steal Crypto Currency Wallets 11->63 18 debug.exe 11->18         started        file7 signatures8 process9 signatures10 41 Antivirus detection for dropped file 18->41 43 Multi AV Scanner detection for dropped file 18->43 45 Machine Learning detection for dropped file 18->45 47 3 other signatures 18->47 21 WerFault.exe 23 9 18->21         started        23 RegSvcs.exe 2 18->23         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/148e0e3a32f4e4fa38f170fcf8543177ec8aef1ab75d79821446482618e00b1b/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-05-22 07:19:08 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 26 (92.31%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=csha4ors6tspuohrod6pqvbro7wiv3y2w5oxtaquizecmghabmnq._file
Verdict:
malicious
Similar samples:
059eb55a25da0be489dabbc4375dd365788c182234b8d73dc72e6845654bb2a2
RedLineStealer
7543b33ac3e32becc57d975175fe441db7e86bd2edc7faa73b379f3ed7185c3d
RedLineStealer
7605a5d355941ddf465272bd31583c254584b65b230c0fe7a93b8f887c5af3aa
RedLineStealer
9d999627deac3d67198da86f03c85f6b41e3caa929ea311656b592766642ae1f
RedLineStealer
ad10c5da6a30db60f1f6f9506d9f5ad05e129972fdb59fa393fbf9102971b605
RedLineStealer
dcc028b3f9cf27ce82f5c4aff114e0b664cbdc39a65bd81c234f111bbfd9429e
RedLineStealer
+ 5'167 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@sdsaads2 infostealer spyware
Link:
https://tria.ge/reports/220522-h5hh5shah2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
104.168.44.52:80
Unpacked files
SH256 hash:
a4f1acc3c46938e24281325acf4a6512d2a7162fe6956f69156db3df3a3a1b73
MD5 hash:
a1cd7db16ce4653497c0b75806c5e479
SHA1 hash:
12d18d4cb6285eb3da7565e5cab56976186b7849
Link:
https://www.unpac.me/results/e7d8f686-f4d3-4866-a0f1-84e86fefb1e4/
SH256 hash:
148e0e3a32f4e4fa38f170fcf8543177ec8aef1ab75d79821446482618e00b1b
MD5 hash:
8306b5641914d5ecb3c256be8092a391
SHA1 hash:
7994fcb9cb806fbb6a3cd6b6aee4b8c190fbc6d2
Link:
https://www.unpac.me/results/e7d8f686-f4d3-4866-a0f1-84e86fefb1e4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/148e0e3a32f4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.32
Link:
https://yomi.yoroi.company/submissions/148e0e3a32f4e4fa38f170fcf8543177ec8aef1ab75d79821446482618e00b1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 148e0e3a32f4e4fa38f170fcf8543177ec8aef1ab75d79821446482618e00b1b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/273391/

Comments