MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 260d69ea7e9147cacca89536dc28598a00707c37c568c610d119faa532ac0a8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 260d69ea7e9147cacca89536dc28598a00707c37c568c610d119faa532ac0a8d
SHA3-384 hash: fa4ec21334d768601da82b175962f4adfb60a58f2e42aaaa242b594008cb01075b4eb0dddf8b97f5306ab0755a752921
SHA1 hash: 83b7a74ae463182dbe97deba5e0a9afd4678add9
MD5 hash: b058a5760632ac1ad24003057fddd33d
humanhash: skylark-timing-equal-missouri
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:720'896 bytes
First seen:2022-11-04 19:45:12 UTC
Last seen:2022-11-05 11:36:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9cad64104356d075a08492c873a04aa6 (2 x RedLineStealer, 1 x ArkeiStealer, 1 x DCRat)
ssdeep 12288:KBUqjQRY+mRkiak3AvdDnJXXkQEiCydpyIfKVOkDpLh4NudwuK+zPHuQ8Fhfa3g:KBUqjQ++mRkiaVtEiB6IfKpLKs5yAw
Threatray 16'119 similar samples on MalwareBazaar
TLSH T1D1E49E023D818436C676363145A9EFB899BEA0311F255ADFB3A8173A1F242D19F3753B
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc759438714_648956845?hash=Yj5E1IrT8zZo3SykZgeFdVx9XNqeYW5DOGZYrtbMSm4&dl=G42TSNBTHA3TCNA:1667590757:zcr0wTgeqQSkrMz9LHfBDjfbRY8xlkAHA0rvEMSn3uT&api=1&no_preview=1#1

Intelligence

File Origin
# of uploads :
355
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-04 19:51:24 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/d61b0be2-0ecd-49f3-996f-fe06c1e301bc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/328793/
Detection(s):
Can't access file ERROR
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/48668/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63656bfb775605b3a4f39c10/reports/f8208b8c-2a0f-474f-9681-df45f09cf273/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8667d96c-dded-4e64-b716-703f984084bc
Result
Threat name:
Raccoon Stealer v2, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1105719
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Modifies power options to not sleep / hibernate
Modifies the hosts file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Potential malicious VBS script found (suspicious strings)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Raccoon Stealer v2
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 738382 Sample: file.exe Startdate: 04/11/2022 Architecture: WINDOWS Score: 100 86 Snort IDS alert for network traffic 2->86 88 Multi AV Scanner detection for domain / URL 2->88 90 Malicious sample detected (through community Yara rule) 2->90 92 8 other signatures 2->92 9 file.exe 1 2->9         started        11 MoUSO.exe 2->11         started        14 cmd.exe 2->14         started        16 3 other processes 2->16 process3 signatures4 18 vbc.exe 18 11 9->18         started        23 conhost.exe 9->23         started        128 Antivirus detection for dropped file 11->128 130 Detected unpacking (changes PE section rights) 11->130 132 Tries to detect sandboxes and other dynamic analysis tools (window names) 11->132 140 5 other signatures 11->140 134 Uses cmd line tools excessively to alter registry or file data 14->134 136 Uses powercfg.exe to modify the power settings 14->136 138 Modifies power options to not sleep / hibernate 14->138 25 conhost.exe 14->25         started        27 sc.exe 14->27         started        35 9 other processes 14->35 29 conhost.exe 16->29         started        31 conhost.exe 16->31         started        33 powercfg.exe 16->33         started        37 4 other processes 16->37 process5 dnsIp6 72 51.89.201.21, 49699, 7161 OVHFR France 18->72 74 transfer.sh 144.76.136.153, 443, 49700, 49701 HETZNER-ASDE Germany 18->74 76 cdn.discordapp.com 162.159.129.233, 443, 49703, 49704 CLOUDFLARENETUS United States 18->76 58 C:\Users\user\AppData\Local\Temp\su2p.exe, PE32+ 18->58 dropped 60 C:\Users\user\AppData\Local\...\setu2sp.exe, PE32+ 18->60 dropped 62 C:\Users\user\AppData\Local\Temp\setu2p.exe, PE32 18->62 dropped 64 C:\Users\user\AppData\Local\...\s32eu2p.exe, PE32 18->64 dropped 94 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->94 96 Potential malicious VBS script found (suspicious strings) 18->96 98 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 18->98 100 2 other signatures 18->100 39 s32eu2p.exe 17 18->39         started        44 su2p.exe 18->44         started        46 setu2sp.exe 1 18->46         started        48 2 other processes 18->48 file7 signatures8 process9 dnsIp10 78 dba692117be7b6d3480fe5220fdd58b38bf.xyz 104.21.17.54, 443, 49706, 49707 CLOUDFLARENETUS United States 39->78 66 C:\Users\user\AppData\Local\cache\MoUSO.exe, PE32 39->66 dropped 102 Antivirus detection for dropped file 39->102 104 Multi AV Scanner detection for dropped file 39->104 106 Detected unpacking (changes PE section rights) 39->106 126 4 other signatures 39->126 50 schtasks.exe 1 39->50         started        68 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 44->68 dropped 70 C:\Windows\System32\drivers\etc\hosts, ASCII 44->70 dropped 108 Query firmware table information (likely to detect VMs) 44->108 110 Machine Learning detection for dropped file 44->110 112 Modifies the hosts file 44->112 114 Adds a directory exclusion to Windows Defender 44->114 80 youtube-ui.l.google.com 216.58.215.238, 443, 49708 GOOGLEUS United States 46->80 82 www.youtube.com 46->82 116 Tries to harvest and steal browser information (history, passwords, etc) 46->116 118 Hides threads from debuggers 46->118 120 Tries to detect sandboxes / dynamic malware analysis system (registry check) 46->120 84 iplogger.com 148.251.234.93, 443, 49702 HETZNER-ASDE Germany 48->84 122 System process connects to network (likely due to code injection or exploit) 48->122 124 May check the online IP address of the machine 48->124 52 conhost.exe 48->52         started        54 vbc.exe 48->54         started        file11 signatures12 process13 process14 56 conhost.exe 50->56         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/260d69ea7e9147cacca89536dc28598a00707c37c568c610d119faa532ac0a8d/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-11-04 19:46:09 UTC
File Type:
PE (Exe)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eygwt2t6sfd4vtfisu3nykczriaha7bxyvummegrdh5kkmvmbkgq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
059b97d2db52813056ebdb7d6ea2ca90f9a7b10d4813b919b2ea78408a6e1508
RedLineStealer
130135c0b095014c9ba2c3b17c940611c4678534cf4f650b94fd2f4f8a32b28e
RedLineStealer
26f426fd4ff119e8830681f0692ff3b627f6c5a0d8905c2ca07b6b4298e07f95
RedLineStealer
96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881
RedLineStealer
c00a6a16560557073649393b2ef306dbc831c8bd6ca53882f6e3363a0ed82380
RedLineStealer
cdafcc7bc094d89f02d5ea8529abedd613b96874b5226004c975af80525adff4
RedLineStealer
d6ec737d10afdaf38cafede9fde045dd3ce7bc72c6ee13df33e018f0e7149893
RedLineStealer
daf4c0820c45f6be84cf248504e10bfee063ea6fc8de3b397adaa6682e4bb610
RedLineStealer
+ 16'109 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:xmrig botnet:4cef2ce4f1a8bc40a1ff7364d440a62a botnet:logsdiller cloud (tg: @logsdillabot) evasion infostealer miner spyware stealer themida trojan upx
Link:
https://tria.ge/reports/221104-ygyhfsccfm/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Uses the VBS compiler for execution
Blocklisted process makes network request
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Stops running service(s)
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner payload
Modifies security service
Raccoon
RedLine
RedLine payload
Suspicious use of NtCreateUserProcessOtherParentProcess
xmrig
Malware Config
C2 Extraction:
51.89.201.21:7161
http://79.137.197.212/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a77d71be-725c-4a82-b584-2a611d7f532d
Unpacked files
SH256 hash:
260d69ea7e9147cacca89536dc28598a00707c37c568c610d119faa532ac0a8d
MD5 hash:
b058a5760632ac1ad24003057fddd33d
SHA1 hash:
83b7a74ae463182dbe97deba5e0a9afd4678add9
Link:
https://www.unpac.me/results/8a6227c4-f7d4-4246-89d6-1d0e3eaea2f4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/260d69ea7e91/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/260d69ea7e9147cacca89536dc28598a00707c37c568c610d119faa532ac0a8d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/328793/

Comments