MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22396d9d191dd97ff3e82fe760d742da305ca164bbad6922bcaa4829ce442a31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22396d9d191dd97ff3e82fe760d742da305ca164bbad6922bcaa4829ce442a31
SHA3-384 hash: 875a76350ee29c0994bbad31c975caba9a24bc731aff2ced5ac87063661379c101a48ab74272f5968374215d014185e8
SHA1 hash: 3c1d34c4e7530185f3c2a7ef3477826d4323a5c2
MD5 hash: e05ce94fd7a0284817c53b5bfbdf3d74
humanhash: floor-yankee-white-undress
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:5'236'584 bytes
First seen:2022-08-30 09:49:46 UTC
Last seen:2022-08-30 13:50:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 172750858dcc0719eed08c952858023c (117 x RedLineStealer, 3 x N-W0rm, 1 x AsyncRAT)
ssdeep 98304:lCECnpK/ZXVkXjVFQSnhhNbfCnsSZddxePNHSLB8LhsPCso9b5l:lJJV2jVphzWeVm8LmCVRT
Threatray 578 similar samples on MalwareBazaar
TLSH T18836023312E13089D0E6C83D8537BEA535F612F68F41ACBAED9A55C529325F0B633993
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0b558aa87a760123 (2 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:Dell Alienware x15 R1 X15-9970) silver Core i7-11800H/32G/512G SSD 15 FHD IPS 360Hz AGNV RTX3070 8G
Issuer:Dell Alienware x15 R1 X15-9970) silver Core i7-11800H/32G/512G SSD 15 FHD IPS 360Hz AGNV RTX3070 8G
Algorithm:sha1WithRSAEncryption
Valid from:2022-08-29T11:02:46Z
Valid to:2032-08-30T11:02:46Z
Serial number: 5d2025d23e399eba4225e8da2c96db5f
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: a797a5f655c2a71b3f0963e07cdab9eba00f85f9dc678fb85b2171edadb781b0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://www.naturacenterarequipa.com/wp-includes/css/v28080.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-08-30 09:52:00 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/ace8215d-7040-4034-a796-53b8d370b2d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/302473/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.15215.17370.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the system32 subdirectories
Sending a custom TCP request
Creating a file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a recently created file
Replacing files
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm overlay packed
Link:
https://www.filescan.io/uploads/630ddd963e9e50b1baec6e41/reports/d53fc5d6-7741-413c-9ccf-de204a36dd17/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0f4a6e22-7a2d-47fe-b8f9-72b2db31cb7f
Result
Threat name:
MinerDownloader, RedLine, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1060394
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Contains functionality to register a low level keyboard hook
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Schedule system process
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Generic MinerDownloader
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 692911 Sample: file.exe Startdate: 30/08/2022 Architecture: WINDOWS Score: 100 85 Snort IDS alert for network traffic 2->85 87 Multi AV Scanner detection for domain / URL 2->87 89 Malicious sample detected (through community Yara rule) 2->89 91 15 other signatures 2->91 10 file.exe 15 7 2->10         started        process3 dnsIp4 71 morewallet.org 162.55.163.158, 49737, 81 ACPCA United States 10->71 73 api.ip.sb 10->73 75 37.139.129.226, 49751, 80 LVLT-10753US Germany 10->75 57 C:\Users\user\AppData\...\notification.exe, PE32 10->57 dropped 59 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 10->59 dropped 95 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->95 97 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->97 99 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 10->99 101 3 other signatures 10->101 15 notification.exe 8 10->15         started        file5 signatures6 process7 file8 61 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 15->61 dropped 63 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 15->63 dropped 77 Multi AV Scanner detection for dropped file 15->77 79 Contains functionality to register a low level keyboard hook 15->79 19 cmd.exe 2 15->19         started        signatures9 process10 process11 21 alex.exe 14 31 19->21         started        26 7z.exe 2 19->26         started        28 7z.exe 3 19->28         started        30 4 other processes 19->30 dnsIp12 65 github.com 140.82.121.4, 443, 49789, 49790 GITHUBUS United States 21->65 67 raw.githubusercontent.com 185.199.108.133, 443, 49791, 49793 FASTLYUS Netherlands 21->67 69 pastebin.com 104.20.68.143, 443, 49788 CLOUDFLARENETUS United States 21->69 49 C:\ProgramData\Dllhost\winlogson.exe, PE32+ 21->49 dropped 51 C:\ProgramData\Dllhost\dllhost.exe, PE32 21->51 dropped 53 C:\ProgramData\Dllhost\WinRing0x64.sys, PE32+ 21->53 dropped 93 Sample is not signed and drops a device driver 21->93 32 cmd.exe 1 21->32         started        35 cmd.exe 21->35         started        37 cmd.exe 21->37         started        55 C:\Users\user\AppData\Local\Temp\...\alex.exe, PE32 26->55 dropped file13 signatures14 process15 signatures16 81 Encrypted powershell cmdline option found 32->81 83 Uses schtasks.exe or at.exe to add and modify task schedules 32->83 39 powershell.exe 5 32->39         started        41 conhost.exe 32->41         started        43 conhost.exe 35->43         started        45 schtasks.exe 35->45         started        47 conhost.exe 37->47         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22396d9d191dd97ff3e82fe760d742da305ca164bbad6922bcaa4829ce442a31/
Threat name:
Win32.Trojan.Redlinestealer
Create hunting rule
Status:
Malicious
First seen:
2022-08-30 09:50:23 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ei4w3hizdxmx747if7twbv2c3iyfzilexowwsiv4vjecttsefiyq._file
Verdict:
malicious
Similar samples:
0eaa5732da6bceca28eb5309269d90d9f68f80adf9e2bfc83494d173d90b6d98
RedLineStealer
3a25da07a992068bb3c251387f4c2f3fd61818eea0939a700a4c2c3bedfca312
RedLineStealer
4aa853c8b52d8846ca5593c6af59c6bcb925027b7227283cedebf97303ad7241
RedLineStealer
57c9630ff4575c0881314c5f31f4177249c84218642cef6c3896fbc6337c380a
RedLineStealer
9065776746efada2a55a664fec550d5ac9d731fb3fd9a9204dda292470e5f915
RedLineStealer
c9a69a518fddd5eb4740cf598af5e003297919dbe665652f33e36b81dff3868c
RedLineStealer
fb0faef2d43ab2e360980b2b43483aeb22eefafaba5487e27a10dd91680077c0
RedLineStealer
+ 568 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220830-ltyyjagec7/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine payload
Unpacked files
SH256 hash:
ee9badc7b1e0b78a9d7cf2d98eed270a6ee955a7a3523d7ebe458a71d00dac4e
MD5 hash:
284a6e2de83ce48ca0b16c8f70076131
SHA1 hash:
8892106e02493827ed7cdc5e83cf30e56d9d3d95
Link:
https://www.unpac.me/results/cf277dc3-3ad9-4a12-bd94-5ae785cd98da/
SH256 hash:
d7a3d2da7699ede7b374524d704899f1251fff8093393262b33c814ac23ffdc9
MD5 hash:
2009d452f6e6006e1642319b7b39147e
SHA1 hash:
86b049b37bcd7118e8e8c191eb470b1da320116a
Link:
https://www.unpac.me/results/cf277dc3-3ad9-4a12-bd94-5ae785cd98da/
SH256 hash:
22396d9d191dd97ff3e82fe760d742da305ca164bbad6922bcaa4829ce442a31
MD5 hash:
e05ce94fd7a0284817c53b5bfbdf3d74
SHA1 hash:
3c1d34c4e7530185f3c2a7ef3477826d4323a5c2
Link:
https://www.unpac.me/results/cf277dc3-3ad9-4a12-bd94-5ae785cd98da/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/22396d9d191d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22396d9d191dd97ff3e82fe760d742da305ca164bbad6922bcaa4829ce442a31

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/302473/
  
URLhaus
https://urlhaus.abuse.ch/url/2284836/

Comments