MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546
SHA3-384 hash: 28af02d320b4c24215d75084bf79377ab7982cc620a8bd76094a9521e4059cca25f5d06e5c351123d3edbd2b3ed3a7d4
SHA1 hash: 61d4f9a1ea9457e667006bb8c8911c91ab00c487
MD5 hash: e82ce292a4c410c44c1f4da25d02a167
humanhash: iowa-tango-blossom-zulu
File name:e82ce292a4c410c44c1f4da25d02a167
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:371'712 bytes
First seen:2021-07-14 22:18:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:rVwKqovbf+37cAc2FoYj08mnkpFLTmf5fH9:ZwK3vbf+37cAc2FoS08mnkpFLTmf5fH9
Threatray 748 similar samples on MalwareBazaar
TLSH T1A484242864BFC01985E3EEA12DDCA8FBD99A95E3640C743701B4633B8B51B84DE4F479
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.63:23098 https://threatfox.abuse.ch/ioc/160581/

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e82ce292a4c410c44c1f4da25d02a167
Verdict:
Malicious activity
Analysis date:
2021-07-14 22:21:57 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/81b94b99-b451-4363-9755-22d13c13d85d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171836/
Detection(s):
Win.Packed.Generickdz-9874565-0
Create hunting rule

Win.Packed.Redline-9876022-1
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fa1563b3-0278-43f4-ab19-36aac4c47ac3
Result
Threat name:
RedLine Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816599
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Allocates memory in foreign processes
Connects to a pastebin service (likely for C&C)
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 449010 Sample: SgCDxPdEul Startdate: 15/07/2021 Architecture: WINDOWS Score: 100 138 Found malware configuration 2->138 140 Malicious sample detected (through community Yara rule) 2->140 142 Multi AV Scanner detection for submitted file 2->142 144 9 other signatures 2->144 11 SgCDxPdEul.exe 2 2->11         started        15 services64.exe 3 2->15         started        process3 dnsIp4 100 C:\Users\user\AppData\...\SgCDxPdEul.exe.log, ASCII 11->100 dropped 170 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->170 172 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->172 174 Injects a PE file into a foreign processes 11->174 18 SgCDxPdEul.exe 15 30 11->18         started        23 conhost.exe 11->23         started        132 sanctam.net 15->132 134 raw.githubusercontent.com 15->134 136 github.com 15->136 176 Machine Learning detection for dropped file 15->176 178 Injects code into the Windows Explorer (explorer.exe) 15->178 180 Writes to foreign memory regions 15->180 182 2 other signatures 15->182 25 explorer.exe 15->25         started        27 cmd.exe 15->27         started        file5 signatures6 process7 dnsIp8 114 185.215.113.63, 23098, 49738, 49740 WHOLESALECONNECTIONSNL Portugal 18->114 116 api.ip.sb 18->116 118 y40.miraimibun.ru 217.107.34.191, 443, 49744 RTCOMM-ASRU Russian Federation 18->118 96 C:\Users\user\AppData\Local\...\71120815.exe, PE32+ 18->96 dropped 150 Tries to harvest and steal browser information (history, passwords, etc) 18->150 152 Tries to steal Crypto Currency Wallets 18->152 29 71120815.exe 8 18->29         started        154 Uses schtasks.exe or at.exe to add and modify task schedules 23->154 33 conhost.exe 23->33         started        35 schtasks.exe 1 23->35         started        120 xmr.pool.minergate.com 25->120 122 pool.minergate.com 25->122 124 pastebin.com 25->124 156 System process connects to network (likely due to code injection or exploit) 25->156 158 Query firmware table information (likely to detect VMs) 25->158 37 conhost.exe 27->37         started        39 schtasks.exe 27->39         started        file9 signatures10 process11 file12 102 C:\Users\user\AppData\...\sihost64.exe, PE32+ 29->102 dropped 104 C:\Users\user\AppData\...\services64.exe, PE32+ 29->104 dropped 184 Machine Learning detection for dropped file 29->184 186 Sample is not signed and drops a device driver 29->186 41 services64.exe 29->41         started        45 sihost64.exe 29->45         started        47 cmd.exe 1 29->47         started        signatures13 process14 dnsIp15 126 github.com 140.82.121.3, 443, 49759, 49762 GITHUBUS United States 41->126 128 raw.githubusercontent.com 185.199.109.133, 443, 49760, 49763 FASTLYUS Netherlands 41->128 130 sanctam.net 185.65.135.248, 49758, 49761, 58899 ESAB-ASSE Sweden 41->130 160 Injects code into the Windows Explorer (explorer.exe) 41->160 162 Writes to foreign memory regions 41->162 164 Allocates memory in foreign processes 41->164 168 2 other signatures 41->168 49 explorer.exe 41->49         started        53 cmd.exe 41->53         started        166 Machine Learning detection for dropped file 45->166 55 services64.exe 45->55         started        58 services64.exe 45->58         started        60 services64.exe 45->60         started        62 2 other processes 45->62 signatures16 process17 dnsIp18 106 49.12.80.38, 3333, 49774, 49776 HETZNER-ASDE Germany 49->106 108 49.12.80.40, 3333, 49765, 49771 HETZNER-ASDE Germany 49->108 112 3 other IPs or domains 49->112 146 System process connects to network (likely due to code injection or exploit) 49->146 148 Query firmware table information (likely to detect VMs) 49->148 64 conhost.exe 53->64         started        66 schtasks.exe 53->66         started        98 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 55->98 dropped 68 cmd.exe 55->68         started        110 192.168.2.1 unknown unknown 58->110 70 cmd.exe 58->70         started        72 cmd.exe 60->72         started        74 cmd.exe 62->74         started        76 cmd.exe 62->76         started        file19 signatures20 process21 process22 94 2 other processes 68->94 78 conhost.exe 70->78         started        80 schtasks.exe 70->80         started        82 conhost.exe 72->82         started        84 schtasks.exe 72->84         started        86 conhost.exe 74->86         started        88 schtasks.exe 74->88         started        90 conhost.exe 76->90         started        92 schtasks.exe 76->92         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 22:09:25 UTC
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgo4ho3bhiiodiwznq7etvrniikfwgsi7plkbb62ntcwmypievda._file
Verdict:
malicious
Similar samples:
45353f79c8ff44867c74c342072bf6437f17d1b158e0ac19b3b0add1e8fb38c9
RedLineStealer
76b87f4f61c849a8af46ebdcb899a0bea036b18f6b473bed34562212eab16b93
RedLineStealer
923fdc536587c13f249d07089d331efbe489f34f8ca7d3986909909b4f468f46
RedLineStealer
d0be6a6be2370c8099de6c46ba61e026bbd62c17ebcf1ec7f1057b05af96f89f
RedLineStealer
e8c4bcdcf46f101cc7126f7bde6955f6a971d06dc2bea9f6499594b475b091e2
RedLineStealer
f2109e01510afe36730bf769c9cdce135de8e43fcb362089b347a8e835635dad
RedLineStealer
f89110f497e2a39c3fc34329b16e5528564bae652fda61cd07410b27e046fdf3
RedLineStealer
fb49ad3836c334d8d06a36a45994eaa52d7629ecbf765fe46aa53825aef56e56
RedLineStealer
feb12de92aa1536ba75f69b41bf74cc3bd8438df7eb0f0705ebbd1de73994624
RedLineStealer
+ 738 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:redline family:xmrig botnet:test1 discovery infostealer miner spyware stealer
Link:
https://tria.ge/reports/210714-rmk3dgkyta/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Cryptocurrency Miner
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
XMRig Miner Payload
RedLine
RedLine Payload
xmrig
Malware Config
C2 Extraction:
185.215.113.63:23098
Unpacked files
SH256 hash:
690c5ec710fd9f35e610eae318b784c021e366f7ede61257492853f6f7263c31
MD5 hash:
d5ba02516bbee09614fce448c92896bc
SHA1 hash:
2411700262d8a851093e6d7131dc656351c670fc
Link:
https://www.unpac.me/results/d1836dd5-10ba-412b-8b48-22fc91606b8f/
SH256 hash:
299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546
MD5 hash:
e82ce292a4c410c44c1f4da25d02a167
SHA1 hash:
61d4f9a1ea9457e667006bb8c8911c91ab00c487
Link:
https://www.unpac.me/results/d1836dd5-10ba-412b-8b48-22fc91606b8f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171836/

Comments


Avatar
zbet commented on 2021-07-14 22:18:21 UTC

url : hxxp://52nv.hiterima.ru/964937807.exe