MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27ff5c94ac88e4473fcfd223818a8d39860cbe0cf2220c28d490c6536aeeba96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27ff5c94ac88e4473fcfd223818a8d39860cbe0cf2220c28d490c6536aeeba96
SHA3-384 hash: 4ede8d80b4e4c69acf7759e1c891b68cbd7159b37ea3944ca2a524db3068ac1ca0b3b6e7662b88f600b45c4964232b53
SHA1 hash: 53e81e515bb02130156d3227ec765f78174a1e90
MD5 hash: ab2801c64da35fb323d84fc1addcf75c
humanhash: nebraska-sad-social-lima
File name:ab2801c64da35fb323d84fc1addcf75c.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'133'624 bytes
First seen:2021-05-14 18:17:02 UTC
Last seen:2021-05-14 18:46:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:MSBNyCLsPwHXa1BzM3ZiF1n138DYYLseKGMEmaZFTTp:lyEsPwHXa1xM3sFp1MD/sD8FXp
Threatray 88 similar samples on MalwareBazaar
TLSH 6C3558513054CD48E72A6B38DC9660F003FCDF81D561826B791C7F983AF2B29A52BF69
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ab2801c64da35fb323d84fc1addcf75c.exe
Verdict:
Malicious activity
Analysis date:
2021-05-14 18:20:28 UTC
Tags:
trojan rat redline evasion
Link:
https://app.any.run/tasks/c2e9c12c-a49c-4cc2-90fa-8cfd5467859a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/156894/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Sending an HTTP POST request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a process from a recently created file
Launching a process
Creating a file
Stealing user critical data
Connection attempt to an infection source
Sending an HTTP POST request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/782162
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 414561 Sample: NzqOz8Fl59.exe Startdate: 14/05/2021 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Yara detected RedLine Stealer 2->53 55 5 other signatures 2->55 7 NzqOz8Fl59.exe 17 44 2->7         started        process3 dnsIp4 33 xanerlaychi.xyz 79.133.98.32, 49744, 49748, 49749 NEOHOST-ASUA Russian Federation 7->33 35 api.ip.sb 7->35 37 5 other IPs or domains 7->37 25 C:\Users\user\AppData\Local\Temp\srvs.exe, PE32 7->25 dropped 27 C:\Users\user\AppData\Local\Temp\sers.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\...29zqOz8Fl59.exe.log, ASCII 7->29 dropped 57 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->57 59 Performs DNS queries to domains with low reputation 7->59 61 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 7->61 63 Tries to steal Crypto Currency Wallets 7->63 12 sers.exe 14 59 7->12         started        16 srvs.exe 14 29 7->16         started        18 iexplore.exe 7->18         started        20 iexplore.exe 7->20         started        file5 signatures6 process7 dnsIp8 39 193.164.6.199, 17645, 49776, 49781 COMNET-ASNTR Turkey 12->39 41 api.ip.sb 12->41 65 Antivirus detection for dropped file 12->65 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->67 69 Machine Learning detection for dropped file 12->69 71 Tries to harvest and steal browser information (history, passwords, etc) 12->71 43 176.111.174.136, 49775, 49779, 49780 WILWAWPL Russian Federation 16->43 45 api.ip.sb 16->45 73 Multi AV Scanner detection for dropped file 16->73 75 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->75 77 Tries to steal Crypto Currency Wallets 16->77 47 iplogger.org 18->47 22 iexplore.exe 18->22         started        signatures9 process10 dnsIp11 31 iplogger.org 88.99.66.31, 443, 49761, 49762 HETZNER-ASDE Germany 22->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27ff5c94ac88e4473fcfd223818a8d39860cbe0cf2220c28d490c6536aeeba96/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-05-14 01:25:07 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e77vzffmrdseop6p2irydcunhgdazpqm6iraykgusddfg2xoxkla._file
Verdict:
malicious
Similar samples:
0ebfb9888d15c1377eb933a088f7aa3dd228523ffee36d7f8718c49d976dab6c
RedLineStealer
1efeb065915f4f4dc1a53837ef5f428b4c73d27fb30086ccb8d792d2f68295a4
RedLineStealer
3c47f8bdb6cb223b1b28ad2401962949c90f1780028be03d775b7d4322aef6f0
RedLineStealer
6fb172bb9c23b3a8067a40f09264c3fa8ecb4f081c659de59560c5d52364d9e9
RedLineStealer
8c2bcfb8657193f893a95fac8d90cabad1b35ed4ed2402dc717523ef255b9e2e
RedLineStealer
abf61356eb007bc0eb51c4208af46dd2ed3d8d94c10dffa7ff5a5c0a4a802a74
RedLineStealer
bbc467be402fa10957b329f79484dd0dfbf30ca52ed4275f0fa2085807786f5a
RedLineStealer
be394c34bc2d5f532f3ddac7e2d692c60401d71858d4ae2f077af559f33ef772
RedLineStealer
c5eee53cdd6b6cbbd5019764f7ad3a74de92d1629619e972b8a3a1a7d2994170
RedLineStealer
d4e27b8e7e1fd965522468bdc3eaf06513dd3a3e7402d9b441ab002dfc892adc
RedLineStealer
+ 78 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery spyware stealer
Link:
https://tria.ge/reports/210514-6fja9vjbt6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27ff5c94ac88e4473fcfd223818a8d39860cbe0cf2220c28d490c6536aeeba96

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 27ff5c94ac88e4473fcfd223818a8d39860cbe0cf2220c28d490c6536aeeba96

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1103586/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/156894/

Comments