MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29b9058449c81cf5aaa57316c620d80a48e2161d583c6e9351b8c44899315505. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs 2 YARA 9 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29b9058449c81cf5aaa57316c620d80a48e2161d583c6e9351b8c44899315505
SHA3-384 hash: ec36ec2d3f925dec9625fb4e3111b51a61df6c0e930b23a1ba5126f0f387187459e1070b7d79da553b1bf77bcf9fd263
SHA1 hash: 60cfe6897dee7fa1df31848955b46d81e364c250
MD5 hash: d36c0114e9621008c6c3476f1ca42948
humanhash: lima-hot-east-nitrogen
File name:29B9058449C81CF5AAA57316C620D80A48E2161D583C6.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'080'704 bytes
First seen:2021-04-30 06:20:45 UTC
Last seen:2021-04-30 07:04:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 49152:NLKJpMbXi5mX9lFjXdfUlApTppXInuYl4Qa25Jxd/ANV+AMNOpcqCbVj2Ao:NLKEbSQ9njX5UW0nuWBJPIjMEpcqCbk
Threatray 363 similar samples on MalwareBazaar
TLSH FDE53361AAF94477E8A24B7009F271B773357C921B35CA1213897CD06CB3AB465327AF
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://185.234.247.183:3214/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.234.247.183:3214/ https://threatfox.abuse.ch/ioc/26606/
185.234.247.183:3214 https://threatfox.abuse.ch/ioc/26607/

Intelligence

File Origin
# of uploads :
2
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/147217/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Creating a process from a recently created file
Deleting a recently created file
DNS request
Sending a UDP request
Adding an access-denied ACE
Connection attempt
Sending an HTTP POST request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/704097
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 400971 Sample: 29B9058449C81CF5AAA57316C62... Startdate: 30/04/2021 Architecture: WINDOWS Score: 92 60 Found malware configuration 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 Yara detected RedLine Stealer 2->64 66 2 other signatures 2->66 10 29B9058449C81CF5AAA57316C620D80A48E2161D583C6.exe 1 7 2->10         started        12 rundll32.exe 2->12         started        process3 process4 14 cmd.exe 1 10->14         started        16 cmd.exe 1 10->16         started        signatures5 19 cmd.exe 2 14->19         started        22 conhost.exe 14->22         started        52 Submitted sample is a known malware sample 16->52 54 Obfuscated command line found 16->54 56 Uses ping.exe to sleep 16->56 58 Uses ping.exe to check the status of other devices and networks 16->58 24 conhost.exe 16->24         started        process6 signatures7 68 Obfuscated command line found 19->68 70 Uses ping.exe to sleep 19->70 26 Storia.com 19->26         started        28 PING.EXE 1 19->28         started        31 findstr.exe 1 19->31         started        process8 dnsIp9 34 Storia.com 1 26->34         started        50 127.0.0.1 unknown unknown 28->50 44 C:\Users\user\AppData\Local\...\Storia.com, Targa 31->44 dropped file10 process11 dnsIp12 46 tJVyaYtoQvIrrvkTmfWDoA.tJVyaYtoQvIrrvkTmfWDoA 34->46 42 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 34->42 dropped 72 Writes to foreign memory regions 34->72 74 Injects a PE file into a foreign processes 34->74 39 RegAsm.exe 15 2 34->39         started        file13 signatures14 process15 dnsIp16 48 185.234.247.183, 3214, 49729 INTERKONEKT-ASPL Russian Federation 39->48
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29b9058449c81cf5aaa57316c620d80a48e2161d583c6e9351b8c44899315505/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-27 06:34:47 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fg4qlbcjzaoplkvfomlmmigybjeoefq5la6g5e2rxdcergjrkucq._file
Verdict:
malicious
Similar samples:
0d5b06c5a7a55b382d9d383884b51fd1bfee2a1166f8778f16f3163207d0d373
RedLineStealer
2f227912aff8b075c24231e4fd18051f8f5cbbba230810f3724de95e62fdba9a
RedLineStealer
4832d7872fbda09f9b51735611d372ff1a6004dc8d821d2f2e26fdbdfc300021
RedLineStealer
75ae1751515b48d24859c91fd08bd0595d84decb06566c1d3eec6363b0be9d82
RedLineStealer
8c1003903aca600a1baf242dc981c2d7ef79a95890cf2bb1a057fa6fea2822a0
RedLineStealer
9bae8f0da8acb0e760eb61482cafc928199f841e10e0426a6650d140be0154c3
RedLineStealer
e1ccbcfb77a8ee31db04f21a4962ed0c117bb65a3ce3e453a6176068a379e011
RedLineStealer
e58ef47a566a73ad01ce7a37c178d1fce2a3282882f814997aab487200cf8005
RedLineStealer
e9a66c730fa980242a636338edc5351b82fc20ac3425b6bc1f3e4ec5ed8a5fe2
RedLineStealer
f1fdac82e4e4da91ba2a9d8122a5f27e11a8342308b18376b189d2cc7468557b
RedLineStealer
+ 353 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:patricia003 infostealer persistence
Link:
https://tria.ge/reports/210430-dsr892yzkj/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.234.247.183:3214
Unpacked files
SH256 hash:
d99145ab93f2f32ed3a553992213cdd23f9cd869e74665e449f55b7b4a461c8f
MD5 hash:
cb4e827ff80fc7cc0ad57315f808df3a
SHA1 hash:
f86a836c9fc6a7b1f4273cb575c5244d955b0fb3
Link:
https://www.unpac.me/results/36f4289d-20ad-49c5-ba31-220e9bec7d9f/
Parent samples :
ec975154fabacbe2d626ab551470dec7500cfcc32507270ef1d0039c44e47d6d
d477322f8d90be3d37d78ab73d97d59e0ae6ca7ac32e2fdefd5668f67cb1fb62
bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7
39f3698e7359c0a93122897138c050ecb0b71d71843f68ba8d05a9ed7e7cb67b
d159901426c9d9c00934d53977abff7932b37f69febdb6cab2a80333e79c3f1a
774368536ee17949132b38f6067b9b6aea5362c1f23fb06410b4e8cec4c2ed5c
bb653dddd858f686a07ac236a6098d9da8dcb8524aedc8da2cb5a6f084cbfebc
edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e
06e81f5bb3b70ddd48d4711afd1f75776bc1e28e787ffd5dab9459083796f437
59a0f409289061eed9d13f294a5d63cf1f72dafb7302272b935aba711a0d1870
9fa64c90a5f724bb282934ee693fac3b8f82a7a08039d52946904262f8d2ec6a
645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe
6d50bd480bb0c65931eb297b28c4af74b966504241fca8cd03de7058a824274d
SH256 hash:
29b9058449c81cf5aaa57316c620d80a48e2161d583c6e9351b8c44899315505
MD5 hash:
d36c0114e9621008c6c3476f1ca42948
SHA1 hash:
60cfe6897dee7fa1df31848955b46d81e364c250
Link:
https://www.unpac.me/results/36f4289d-20ad-49c5-ba31-220e9bec7d9f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29b9058449c81cf5aaa57316c620d80a48e2161d583c6e9351b8c44899315505

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/147217/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-30 07:01:20 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [C0046] File System Micro-objective::Create Directory
2) [C0048] File System Micro-objective::Delete Directory
3) [C0047] File System Micro-objective::Delete File
4) [C0049] File System Micro-objective::Get File Attributes
5) [C0051] File System Micro-objective::Read File
6) [C0050] File System Micro-objective::Set File Attributes
7) [C0052] File System Micro-objective::Writes File
8) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
9) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
10) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
11) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
12) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
13) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
14) [C0042] Process Micro-objective::Create Mutex
15) [C0017] Process Micro-objective::Create Process
16) [C0038] Process Micro-objective::Create Thread
17) [C0018] Process Micro-objective::Terminate Process
18) [C0039] Process Micro-objective::Terminate Thread