MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278
SHA3-384 hash: 8b288a9791a4e27e702caea982b57fd2361052254f3519267a36cf4af387bd23c781ee174c1e474268f0ae0abf0fb0a8
SHA1 hash: c50c297394c849aea972fb922c91117094be38f1
MD5 hash: 74e5ee47e3f1cec8ad5499d20d5e200d
humanhash: freddie-tennessee-monkey-enemy
File name:15f47b7b5ca57126f9f9c51c3949e290553025c32c649.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:57'960 bytes
First seen:2021-11-06 13:31:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:OVj3WT72SslQvWjPjmAQSI71MqDuDkspioQ+Mo:OVjOKSsoUPSLSTqBspOo
Threatray 2'184 similar samples on MalwareBazaar
TLSH T18243BF156FE09423CAD36F7AD5E4A34046B1A6820AC6E75EFCC4621B1EC73E51521FE3
File icon (PE):PE icon
dhash icon 09d4e8f0e8f071b2 (11 x RedLineStealer, 2 x ArkeiStealer, 2 x RaccoonStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
104.168.237.55:44505

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
104.168.237.55:44505 https://threatfox.abuse.ch/ioc/244626/

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/202930/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/618683d543a4f7480911411d/reports/bd57a775-ccf8-4aab-a80d-d50dfe9b7413/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/63475ae0-6520-4d00-8bdf-f5f8f38af701
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/884521
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 516975 Sample: 15f47b7b5ca57126f9f9c51c394... Startdate: 06/11/2021 Architecture: WINDOWS Score: 100 39 youtube-ui.l.google.com 2->39 41 www.youtube.com 2->41 63 Found malware configuration 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 Yara detected RedLine Stealer 2->67 69 Found many strings related to Crypto-Wallets (likely being stolen) 2->69 8 15f47b7b5ca57126f9f9c51c3949e290553025c32c649.exe 15 7 2->8         started        signatures3 process4 dnsIp5 43 bitbucket.org 104.192.141.1, 443, 49744 AMAZON-02US United States 8->43 45 s3-w.us-east-1.amazonaws.com 52.217.79.140, 443, 49745 AMAZON-02US United States 8->45 47 2 other IPs or domains 8->47 33 15f47b7b5ca57126f9...90553025c32c649.exe, PE32 8->33 dropped 35 15f47b7b5ca57126f9...exe:Zone.Identifier, ASCII 8->35 dropped 37 15f47b7b5ca57126f9...3025c32c649.exe.log, ASCII 8->37 dropped 71 Tries to delay execution (extensive OutputDebugStringW loop) 8->71 73 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->73 13 15f47b7b5ca57126f9f9c51c3949e290553025c32c649.exe 8->13         started        17 powershell.exe 18 8->17         started        19 powershell.exe 18 8->19         started        21 4 other processes 8->21 file6 signatures7 process8 dnsIp9 49 104.168.237.55, 44505, 49749 HOSTWINDSUS United States 13->49 75 Multi AV Scanner detection for dropped file 13->75 77 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->77 79 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->79 81 2 other signatures 13->81 59 2 other IPs or domains 17->59 23 conhost.exe 17->23         started        51 youtube-ui.l.google.com 19->51 53 www.youtube.com 19->53 25 conhost.exe 19->25         started        55 192.168.2.1 unknown unknown 21->55 57 youtube-ui.l.google.com 21->57 61 5 other IPs or domains 21->61 27 conhost.exe 21->27         started        29 conhost.exe 21->29         started        31 conhost.exe 21->31         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-11-06 13:32:05 UTC
AV detection:
5 of 45 (11.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cx2hw624uvysn6pzyuodsspcsbktajodfrsj7rn5n3m2f73smj4a._file
Verdict:
malicious
Similar samples:
a855f110470f35fa83d40ffa1eb3748a0c2fc4cf11bdb4bb01e171c031097bf1
RedLineStealer
ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c
RedLineStealer
e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62af8066d59c283114c2d3
RedLineStealer
f1e4cf5b0fc8658f900febca637c9071fe7396f410015c41284768eac593ffa5
RedLineStealer
f30dab44e1b3c177c002b35c5e9a933b79345c378dbf434b96de62051bbb1eb0
RedLineStealer
f8106931b484cc61bd73a4aed15d2b940282316283ebba4f03de924b97468b25
RedLineStealer
fd50e5ce3b80417115401a4cc61ba7efd5c4d6f13d9166c26cc456b111d39fbb
RedLineStealer
+ 2'174 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211106-qsyzcseda5/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
104.168.237.55:44505
Unpacked files
SH256 hash:
4240a43f279f871140385c5822dd618b0851d7a87574ebbaa76d554a8c216050
MD5 hash:
8acb3fca8319ae99f1c89800c44773a0
SHA1 hash:
de24b77c31174ac5fcc92fbc7df9825536de9277
Link:
https://www.unpac.me/results/313820cc-4519-4277-be22-60564f5586bf/
SH256 hash:
15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278
MD5 hash:
74e5ee47e3f1cec8ad5499d20d5e200d
SHA1 hash:
c50c297394c849aea972fb922c91117094be38f1
Link:
https://www.unpac.me/results/313820cc-4519-4277-be22-60564f5586bf/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/15f47b7b5ca5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.71
Link:
https://yomi.yoroi.company/submissions/15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/202930/

Comments