MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14a79c24ccf73fc501960c7c01abf141a0016dadf4744adb9189448e01c1454e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14a79c24ccf73fc501960c7c01abf141a0016dadf4744adb9189448e01c1454e
SHA3-384 hash: d960df97aba44202cc49ceef230dc015d42b3bcfb4bb2b9329d9c370217e38b43692d486765cfe3d7c0f11303a9f81b7
SHA1 hash: 32fa8dc949db4306f0ec944d940977482f7159eb
MD5 hash: efcaf7f33137a9bb240bbf1f5b680d72
humanhash: skylark-yellow-kentucky-bluebird
File name:efcaf7f33137a9bb240bbf1f5b680d72
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'963'160 bytes
First seen:2021-11-11 11:23:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:hDk4F4W53/L57EYq+kb4ZMx1m1zmxldw+heJC/+/HakimdcOW8pIy+QDWYYOu4O:hDd53vUoMx1m1zm5fX/+/6MW8eyQ
Threatray 3'437 similar samples on MalwareBazaar
TLSH T162D5F141AE7C486BC89AC230AD5E4E79E962AD03BE6505273659FD0CFEF3341495E80F
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/204957/
Detection(s):
Win.Dropper.Reline-9906719-0
Create hunting rule

Win.Packed.Zusy-9907366-0
Create hunting rule

Win.Packed.Zusy-9907508-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/618cfd57dec3347825a1f573/reports/993a69e2-b0e7-4dc9-b5f2-3ce6a12d2b05/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4f9d57c4-ca30-4932-9546-9fe2ef9f9afc
Result
Threat name:
Amadey RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/887408
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Modifies the windows firewall
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicius Add Task From User AppData Temp
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 519881 Sample: k0nAx7VQ5T Startdate: 11/11/2021 Architecture: WINDOWS Score: 100 98 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->98 100 Multi AV Scanner detection for submitted file 2->100 102 Yara detected RedLine Stealer 2->102 104 6 other signatures 2->104 12 k0nAx7VQ5T.exe 15 8 2->12         started        17 rnyuf.exe 2->17         started        process3 dnsIp4 92 185.215.113.111, 49790, 59111 WHOLESALECONNECTIONSNL Portugal 12->92 94 162.159.129.233, 443, 49795 CLOUDFLARENETUS United States 12->94 96 2 other IPs or domains 12->96 78 C:\Users\user\AppData\Local\Temp\vms.exe, PE32 12->78 dropped 80 C:\Users\user\AppData\Local\Temp\slhost.exe, PE32+ 12->80 dropped 82 C:\Users\user\AppData\...\k0nAx7VQ5T.exe.log, ASCII 12->82 dropped 132 Detected unpacking (changes PE section rights) 12->132 134 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->134 136 Query firmware table information (likely to detect VMs) 12->136 142 3 other signatures 12->142 19 slhost.exe 22 12->19         started        24 vms.exe 4 12->24         started        138 Hides threads from debuggers 17->138 140 Tries to detect sandboxes / dynamic malware analysis system (registry check) 17->140 file5 signatures6 process7 dnsIp8 86 iplogger.org 88.99.66.31, 80 HETZNER-ASDE Germany 19->86 88 bitbucket.org 104.192.141.1, 443, 49798, 49811 AMAZON-02US United States 19->88 90 3 other IPs or domains 19->90 72 C:\ProgramData\UpSys.exe, PE32+ 19->72 dropped 74 C:\Users\user\AppData\Local\...\UpSys[1].exe, PE32+ 19->74 dropped 108 Query firmware table information (likely to detect VMs) 19->108 110 May check the online IP address of the machine 19->110 112 Machine Learning detection for dropped file 19->112 118 2 other signatures 19->118 26 powershell.exe 1 31 19->26         started        29 cmd.exe 19->29         started        31 cmd.exe 19->31         started        36 14 other processes 19->36 76 C:\Users\user\AppData\Local\...\rnyuf.exe, PE32 24->76 dropped 114 Hides threads from debuggers 24->114 116 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->116 33 rnyuf.exe 24->33         started        file9 signatures10 process11 dnsIp12 120 Uses netsh to modify the Windows network and firewall settings 26->120 38 UpSys.exe 26->38         started        40 conhost.exe 26->40         started        42 netsh.exe 26->42         started        44 conhost.exe 29->44         started        46 taskkill.exe 29->46         started        52 2 other processes 31->52 84 depressionk1d.ug 178.208.83.45, 49808, 49809, 49810 VDSINA-ASRU Russian Federation 33->84 122 Query firmware table information (likely to detect VMs) 33->122 124 Tries to detect sandboxes and other dynamic analysis tools (window names) 33->124 126 Machine Learning detection for dropped file 33->126 128 3 other signatures 33->128 48 cmd.exe 33->48         started        50 schtasks.exe 33->50         started        54 18 other processes 36->54 signatures13 process14 process15 56 UpSys.exe 38->56         started        58 reg.exe 48->58         started        61 conhost.exe 48->61         started        63 conhost.exe 50->63         started        signatures16 65 UpSys.exe 56->65         started        130 Creates an undocumented autostart registry key 58->130 process17 process18 67 powershell.exe 65->67         started        signatures19 106 Creates files in the system32 config directory 67->106 70 conhost.exe 67->70         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14a79c24ccf73fc501960c7c01abf141a0016dadf4744adb9189448e01c1454e/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-11-10 18:32:16 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cstzyjgm6474kamwbr6adk7rigqac3nn6r2evw4rrfci4aobivha._file
Verdict:
malicious
Similar samples:
03555d8ea739df664c3eb88e62a30e7c590233eff39c2dfe7f72bd717eb3d716
RedLineStealer
075811c1b041821aa0902e5035ab2177e6c97c451896ee954d98486d049face6
RedLineStealer
108cad79cd5bd2a947c5b877a55b7d3a6a4ce579aae3f298c0618154c27eb3d4
RedLineStealer
12505bb6e3c63202f22db1d60afd4a0a386ddff8807bf0d1f8583ba57f6413ba
RedLineStealer
41c2bbd61ad11d1fd1e1c8771edd92d1ab5df475c65764c2c5153f6afef84894
RedLineStealer
79eb109f62c883549a6a2b1dbe9428efcc66ca8dcf57a91b87f88d08499b6369
RedLineStealer
a3acdf009a9db20af30be0c6fcdcdc27ad9db3ee9a84bc52d9e6f7d30ec42af2
RedLineStealer
d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a
RedLineStealer
d7b4b6a43396314d34f68e01bb1dd58a673c97519318f6dd67ee46acace6191e
RedLineStealer
+ 3'427 additional samples on MalwareBazaar
Result
Malware family:
amadey
Create hunting rule
Score:
  10/10
Tags:
family:amadey discovery evasion persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/211111-nhp8csbbf4/
Behaviour
Creates scheduled task(s)
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Modifies security service
Malware Config
C2 Extraction:
depressionk1d.ug/k8FppT/index.php
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/9d737c88-8ebb-4fb6-a90e-bc4fd09cbcdb/
SH256 hash:
14a79c24ccf73fc501960c7c01abf141a0016dadf4744adb9189448e01c1454e
MD5 hash:
efcaf7f33137a9bb240bbf1f5b680d72
SHA1 hash:
32fa8dc949db4306f0ec944d940977482f7159eb
Link:
https://www.unpac.me/results/9d737c88-8ebb-4fb6-a90e-bc4fd09cbcdb/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/14a79c24ccf7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/14a79c24ccf73fc501960c7c01abf141a0016dadf4744adb9189448e01c1454e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 14a79c24ccf73fc501960c7c01abf141a0016dadf4744adb9189448e01c1454e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1776303/
Cape
Cape
https://www.capesandbox.com/analysis/204957/

Comments


Avatar
zbet commented on 2021-11-11 11:23:32 UTC

url : hxxp://5.255.98.133/myforum/uploads/223.exe