MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fb9884604c756b8cb315968847b11bcdda329e24a8b710aa4fefd95a880b887. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs 1 YARA 1 File information Comments 1

SHA256 hash:	1fb9884604c756b8cb315968847b11bcdda329e24a8b710aa4fefd95a880b887
SHA3-384 hash:	3612c752ee88bbc1be928e5acd16de5694556a41640fe10b476567d5f9aacfa04ab54fa29943ec6921008282a16814c8
SHA1 hash:	defd8145629b189ea9ee4e9de962334038f352ef
MD5 hash:	32dbc1ba7d94ed0ed778c2e4e42d656a
humanhash:	finch-network-avocado-charlie
File name:	1fb9884604c756b8cb315968847b11bcdda329e24a8b7.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	367'104 bytes
First seen:	2021-04-20 21:40:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0c1de0d2a8383c4df108890e036a0ae1 (4 x TaurusStealer, 1 x Loki, 1 x Formbook)
ssdeep	6144:/KJg6oYY2LhB02L7AL8TgswGejyGmDr5sgdPLsd/tZGXd2mX0nZ0qFVPuq6DbU:yJg6oOtBNHUGgsSwH5HoZuXOZ/PuqoU
Threatray	455 similar samples on MalwareBazaar
TLSH	C574CF127AD0C132D0826C754716C7B18E7E78717A69598BBBC45EB84F347F2EA3132A
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
205.185.119.191:18846

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
205.185.119.191:18846	https://threatfox.abuse.ch/ioc/9319/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/140627/

Detection(s):

Win.Dropper.Raccoon-9852893-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Sending an HTTP POST request

DNS request

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Creating a file in the %temp% directory

Deleting a recently created file

Reading critical registry keys

Sending an HTTP GET request

Connection attempt

Creating a file

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1fb9884604c756b8cb315968847b11bcdda329e24a8b710aa4fefd95a880b887/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-04-19 19:24:00 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d64yqrqey5llrszrlfuii6yrxto2gkpcjkfxccve736zlkeaxcdq._file

Verdict:

malicious

RedLineStealer

16e3380b11358d44b7e1e4cc6ee7ce80ef204321b731a550527375388703163d

RedLineStealer

47b53753c746c7f218f59e32ebdf9e563d50a0eaab3e35c04e6a8e986eeebe36

RedLineStealer

50bd910698476cea1b75d0290d60445b8e6afb51e4fc1dbef0d11b16ef799357

RedLineStealer

5d5c83ef1689244a96edcffb1c59f88a164b2f6c0881214e4338b82c61b28072

RedLineStealer

60922af94a3c7adf6d040dc1bd4d465983a38bd2410c050bef27deda8ce2002f

RedLineStealer

77d58783013a7d18f57937c53e5ac21840df059a8119b47c5c68dbc3a4809013

RedLineStealer

a9773e3061b22b2d3532d1c97ae8aad632cfb3ff7050167b8b1b20c9ddde13fe

RedLineStealer

d26a98d84423d1b79e2f01fe69e09c3fe65841ceb59c1c36b12b84aaafcb77e9

RedLineStealer

fef32dae997902d7d9f73042e5f78dff0eff80691b50dc6e072b1376d6ba368c

RedLineStealer

+ 445 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:1 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210420-da8wyc5f8s/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

205.185.119.191:18846

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1fb9884604c756b8cb315968847b11bcdda329e24a8b710aa4fefd95a880b887

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekshen
Description:	Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/140627/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-20 22:13:37 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0049] File System Micro-objective::Get File Attributes
2) [C0051] File System Micro-objective::Read File
3) [C0050] File System Micro-objective::Set File Attributes
4) [C0052] File System Micro-objective::Writes File
5) [C0007] Memory Micro-objective::Allocate Memory
6) [C0033] Operating System Micro-objective::Console
7) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
8) [C0040] Process Micro-objective::Allocate Thread Local Storage
9) [C0041] Process Micro-objective::Set Thread Local Storage Value
10) [C0018] Process Micro-objective::Terminate Process