MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b6dd998ab259fc57bf7d9a35381fdfe4f63f80eac561e9842613132812f165d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b6dd998ab259fc57bf7d9a35381fdfe4f63f80eac561e9842613132812f165d
SHA3-384 hash: 8e46ccbea02e4e51715ff9e4e2140453913ff5203533854be0b53a533374f0d9dbd9ee33f082e402f9475411d908fb06
SHA1 hash: df9b0a7a6280b8bb8bb866a672bc7ff2736c29b0
MD5 hash: ae54f01f90675f9268588f7eab938ce7
humanhash: twenty-coffee-oranges-sierra
File name:ae54f01f90675f9268588f7eab938ce7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'855'488 bytes
First seen:2022-04-14 17:42:00 UTC
Last seen:2022-04-20 10:23:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a498eee87e4d89512a84502f500181f (138 x AveMariaRAT, 57 x RedLineStealer, 7 x CoinMiner)
ssdeep 49152:OnZn/Z3leRypGbZn+u5p4tCk7XsQhmgOrp9BMiP:OnRmypGbZnX5pUCe8Q87l9b
Threatray 1'141 similar samples on MalwareBazaar
TLSH T19885BEE38352230BF112A83AC11E6E6D7CF20731578FB87767895EE9A31B2D45919B13
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.215.113.80:27715

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.80:27715 https://threatfox.abuse.ch/ioc/519943/

Intelligence

File Origin
# of uploads :
2
# of downloads :
411
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
ae54f01f90675f9268588f7eab938ce7.exe
Verdict:
Malicious activity
Analysis date:
2022-04-14 17:51:40 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/148769fd-c98a-43a1-8c7e-7fb608924927

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/263835/
Detection(s):
SecuriteInfo.com.Trojan.Siggen17.37960.22483.2746.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a window
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Reading critical registry keys
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Sending a TCP request to an infection source
Stealing user critical data
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13909/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/62585d2effe27d5119d0adbf/reports/0998b01a-ba81-44ad-9e3b-3fb7e486cc75/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/64f8cf72-01c8-4f14-b2a2-605b12b95762
Result
Threat name:
RedLine Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/977093
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Blacklisted process start detected (Windows program)
Changes security center settings (notifications, updates, antivirus, firewall)
Detected Stratum mining protocol
DNS related to crypt mining pools
Found malware configuration
Found strings related to Crypto-Mining
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Notepad Making Network Connection
Sigma detected: Suspicious Process Parents
Sigma detected: Suspicious Remote Thread Created
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 609580 Sample: o9lgHgNy59.exe Startdate: 14/04/2022 Architecture: WINDOWS Score: 100 114 xmr-eu1.nanopool.org 2->114 116 easyproducts.org 2->116 156 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->156 158 Found malware configuration 2->158 160 Malicious sample detected (through community Yara rule) 2->160 162 14 other signatures 2->162 13 o9lgHgNy59.exe 1 2->13         started        16 svchost.exe 2->16         started        18 svchost.exe 1 1 2->18         started        21 8 other processes 2->21 signatures3 process4 dnsIp5 178 Writes to foreign memory regions 13->178 180 Allocates memory in foreign processes 13->180 182 Injects a PE file into a foreign processes 13->182 23 AppLaunch.exe 15 7 13->23         started        28 conhost.exe 13->28         started        184 Changes security center settings (notifications, updates, antivirus, firewall) 16->184 30 MpCmdRun.exe 16->30         started        118 127.0.0.1 unknown unknown 18->118 signatures6 process7 dnsIp8 132 185.215.113.80, 27715, 49721 WHOLESALECONNECTIONSNL Portugal 23->132 134 dl.uploadgram.me 176.9.247.226, 443, 49726 HETZNER-ASDE Germany 23->134 110 C:\Users\user\AppData\Local\Temp\fl.exe, PE32+ 23->110 dropped 164 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->164 166 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 23->166 168 Tries to harvest and steal browser information (history, passwords, etc) 23->168 170 Tries to steal Crypto Currency Wallets 23->170 32 fl.exe 1 5 23->32         started        37 conhost.exe 30->37         started        file9 signatures10 process11 dnsIp12 112 185.137.234.33, 49727, 49728, 8080 SELECTELRU Russian Federation 32->112 102 C:\Users\user\AppData\...\RegModule.exe, PE32+ 32->102 dropped 104 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 32->104 dropped 106 C:\Users\user\AppData\Roaming\...\RegData.exe, PE32+ 32->106 dropped 108 C:\Users\user\AppData\...\OneDrive.exe, PE32+ 32->108 dropped 148 Hijacks the control flow in another process 32->148 150 Injects code into the Windows Explorer (explorer.exe) 32->150 152 Writes to foreign memory regions 32->152 154 4 other signatures 32->154 39 explorer.exe 2 32->39         started        41 notepad.exe 1 32->41         started        45 bfsvc.exe 1 32->45         started        47 conhost.exe 32->47         started        file13 signatures14 process15 dnsIp16 49 RegHost.exe 39->49         started        52 curl.exe 39->52         started        55 curl.exe 39->55         started        61 9 other processes 39->61 136 46.105.31.147 OVHFR France 41->136 138 xmr-eu1.nanopool.org 41->138 172 System process connects to network (likely due to code injection or exploit) 41->172 174 Query firmware table information (likely to detect VMs) 41->174 176 Blacklisted process start detected (Windows program) 41->176 57 conhost.exe 41->57         started        59 conhost.exe 45->59         started        signatures17 process18 dnsIp19 140 Hijacks the control flow in another process 49->140 142 Injects code into the Windows Explorer (explorer.exe) 49->142 144 Writes to foreign memory regions 49->144 146 4 other signatures 49->146 63 bfsvc.exe 49->63         started        65 notepad.exe 49->65         started        77 2 other processes 49->77 67 conhost.exe 52->67         started        120 easyproducts.org 193.233.48.63 NETIS-ASRU Russian Federation 55->120 69 conhost.exe 55->69         started        122 192.168.2.1 unknown unknown 61->122 71 conhost.exe 61->71         started        73 conhost.exe 61->73         started        75 conhost.exe 61->75         started        79 5 other processes 61->79 signatures20 process21 process22 81 conhost.exe 63->81         started        83 conhost.exe 65->83         started        85 curl.exe 67->85         started        88 curl.exe 67->88         started        90 curl.exe 67->90         started        92 2 other processes 67->92 dnsIp23 124 easyproducts.org 85->124 94 conhost.exe 85->94         started        126 easyproducts.org 88->126 96 conhost.exe 88->96         started        128 easyproducts.org 90->128 98 conhost.exe 90->98         started        130 easyproducts.org 92->130 100 conhost.exe 92->100         started        process24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b6dd998ab259fc57bf7d9a35381fdfe4f63f80eac561e9842613132812f165d/
Threat name:
Win32.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2022-04-10 15:46:32 UTC
File Type:
PE (Exe)
AV detection:
25 of 41 (60.98%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dnw5tgflewp4k67x3grvhap57zhwh6aovrlb5gccmeytfajpczoq._file
Verdict:
malicious
Similar samples:
24cf5566094b9c99b75303995b503b3285531d1313658f318a931424c9ef46d3
RedLineStealer
4109d37d472fafa83b2c8303afd3fe9c25d58e763d706ae8f660a9f150971665
RedLineStealer
69a7e42a1c0b9413c66f96880ba467ebe5b103740224f0d90dd5ad0862e37a5d
RedLineStealer
c47c10545767892ba8fdaa1ba682295251016938318d807fe40736e5ae832322
RedLineStealer
cf9d82a4d67beb905befac24665ccb76ac0bc9de390e335ab393072c5c37d281
RedLineStealer
f563d62dbc6bcf5f8c0f977bcd3bc66d39ee43cc5abdd63d3de105755dab3f91
RedLineStealer
fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d
RedLineStealer
fe7e378c72ec43fca46360a46a8fc8c0d5ec0f4739ce3286610774fdec47edda
RedLineStealer
+ 1'131 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:metastealer family:redline family:xmrig botnet:@devilstationsix66 evasion infostealer miner persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/220414-v9zpfageh3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
XMRig Miner Payload
Meta Stealer Stealer
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine Payload
xmrig
Malware Config
C2 Extraction:
185.215.113.80:27715
Unpacked files
SH256 hash:
c66d2d160c3ff8f8b1abdbd7e4105d1a3a965be2d955048de90cc9b1eff90869
MD5 hash:
d810374e60e74f94a07863f5f1a7e3ef
SHA1 hash:
cfc50c68dbb964970a0ed9a7d9a80c94b27cb091
Link:
https://www.unpac.me/results/22736795-a8f3-4654-ba2c-fb428f9c0a41/
SH256 hash:
1b6dd998ab259fc57bf7d9a35381fdfe4f63f80eac561e9842613132812f165d
MD5 hash:
ae54f01f90675f9268588f7eab938ce7
SHA1 hash:
df9b0a7a6280b8bb8bb866a672bc7ff2736c29b0
Link:
https://www.unpac.me/results/22736795-a8f3-4654-ba2c-fb428f9c0a41/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/1b6dd998ab259fc57bf7d9a35381fdfe4f63f80eac561e9842613132812f165d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263835/

Comments