MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f0a55a8e0663453f3edf65ef50844fa1f4b161888842ac942f5bc7c4bd2ce02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f0a55a8e0663453f3edf65ef50844fa1f4b161888842ac942f5bc7c4bd2ce02
SHA3-384 hash: b3b3ea50ae5612197bd9baab0196394f35f8236678936aab90da58d083742f9150362ec20cbf92b078a1f98e068f07bf
SHA1 hash: 1972b8287afb1e9cff4a1966145ceabd7181f3ca
MD5 hash: 89654707bfe291db19d82c1740ad2036
humanhash: echo-william-quebec-carpet
File name:2F0A55A8E0663453F3EDF65EF50844FA1F4B161888842.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'538'690 bytes
First seen:2022-10-24 23:55:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1797ab721d550312b93ab992a1e04176 (32 x RedLineStealer, 7 x ErbiumStealer, 1 x PandaStealer)
ssdeep 24576:5LzRE9YcYRlrbgwMNllBH4YLMh7RzAOZoTyy81LG1wL+SNg0vlKNe6Z6El3RuQ5D:JRTOM5Jy81LG1w1K6El3N
TLSH T190C50903AACB0E75DDD23BB4618B533BA734ED30CA2A9B7FF609C53559532C4681A742
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://78.47.204.168/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://78.47.204.168/ https://threatfox.abuse.ch/ioc/891320/

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
2F0A55A8E0663453F3EDF65EF50844FA1F4B161888842.exe
Verdict:
Malicious activity
Analysis date:
2022-10-24 23:57:55 UTC
Tags:
trojan rat redline loader stealer vidar
Link:
https://app.any.run/tasks/72d1575c-2238-4b39-a433-cb5cb07bde70

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/323697/
Detection(s):
Win.Dropper.Babar-9966130-0
Create hunting rule

Win.Packed.Babar-9966141-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/45190/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3aa59a7f-af60-4769-8619-d397ac990100
Result
Threat name:
RedLine, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1097112
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the prolog of user mode functions (user mode inline hooks)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Sigma detected: Stop multiple services
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 729753 Sample: 2F0A55A8E0663453F3EDF65EF50... Startdate: 25/10/2022 Architecture: WINDOWS Score: 100 105 clipper.guru 2->105 123 Snort IDS alert for network traffic 2->123 125 Malicious sample detected (through community Yara rule) 2->125 127 Antivirus detection for dropped file 2->127 129 15 other signatures 2->129 11 2F0A55A8E0663453F3EDF65EF50844FA1F4B161888842.exe 1 2->11         started        14 svcupdater.exe 2->14         started        17 chrome.exe 2->17         started        19 chrome.exe 2->19         started        signatures3 process4 dnsIp5 163 Writes to foreign memory regions 11->163 165 Allocates memory in foreign processes 11->165 167 Injects a PE file into a foreign processes 11->167 21 AppLaunch.exe 15 10 11->21         started        26 conhost.exe 11->26         started        121 clipper.guru 45.159.189.115, 49705, 49887, 80 HOSTING-SOLUTIONSUS Netherlands 14->121 169 Multi AV Scanner detection for dropped file 14->169 171 Machine Learning detection for dropped file 14->171 signatures6 process7 dnsIp8 107 185.215.113.83, 49699, 60722 WHOLESALECONNECTIONSNL Portugal 21->107 109 adigitalshop.com 151.106.122.215, 443, 49701 PLUSSERVER-ASN1DE Germany 21->109 111 2 other IPs or domains 21->111 87 C:\Users\user\AppData\Local\...\test.exe, PE32 21->87 dropped 89 C:\Users\user\AppData\Local\...\ofg.exe, PE32 21->89 dropped 91 C:\Users\user\AppData\Local\...\chrome.exe, MS-DOS 21->91 dropped 93 C:\Users\user\AppData\Local\...\brave.exe, PE32+ 21->93 dropped 131 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->131 133 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->133 135 Tries to harvest and steal browser information (history, passwords, etc) 21->135 137 Tries to steal Crypto Currency Wallets 21->137 28 chrome.exe 21->28         started        32 test.exe 1 21->32         started        34 brave.exe 21->34         started        36 ofg.exe 5 21->36         started        file9 signatures10 process11 file12 97 C:\WindowsbehaviorgraphoogleUpdate.exe, PE32 28->97 dropped 173 Multi AV Scanner detection for dropped file 28->173 175 Detected unpacking (changes PE section rights) 28->175 177 Machine Learning detection for dropped file 28->177 191 2 other signatures 28->191 38 GoogleUpdate.exe 28->38         started        53 3 other processes 28->53 179 Writes to foreign memory regions 32->179 181 Allocates memory in foreign processes 32->181 183 Injects a PE file into a foreign processes 32->183 42 vbc.exe 32->42         started        55 3 other processes 32->55 99 C:\Users\user\AppData\Local\Temp\ADE5.tmp, PE32+ 34->99 dropped 101 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 34->101 dropped 185 Found hidden mapped module (file has been removed from disk) 34->185 187 Adds a directory exclusion to Windows Defender 34->187 189 Maps a DLL or memory area into another process 34->189 45 cmd.exe 34->45         started        47 cmd.exe 34->47         started        49 powershell.exe 34->49         started        57 2 other processes 34->57 103 C:\Users\user\AppData\...\svcupdater.exe, PE32 36->103 dropped 51 cmd.exe 1 36->51         started        signatures13 process14 dnsIp15 113 141.95.93.183, 443, 49706, 49708 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 38->113 115 api.peer2profit.com 172.66.40.196, 443, 49704, 49707 CLOUDFLARENETUS United States 38->115 139 Detected unpacking (changes PE section rights) 38->139 141 Detected unpacking (overwrites its own PE header) 38->141 143 Uses netsh to modify the Windows network and firewall settings 38->143 145 Modifies the windows firewall 38->145 59 netsh.exe 38->59         started        67 2 other processes 38->67 117 t.me 149.154.167.99, 443, 49711 TELEGRAMRU United Kingdom 42->117 119 78.47.204.168, 49717, 80 HETZNER-ASDE Germany 42->119 95 C:\ProgramData\sqlite3.dll, PE32 42->95 dropped 147 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 42->147 149 Tries to harvest and steal browser information (history, passwords, etc) 42->149 151 DLL side loading technique detected 42->151 153 Tries to steal Crypto Currency Wallets 42->153 61 cmd.exe 42->61         started        69 11 other processes 45->69 155 Modifies power options to not sleep / hibernate 47->155 71 5 other processes 47->71 63 conhost.exe 49->63         started        157 Uses cmd line tools excessively to alter registry or file data 51->157 159 Uses schtasks.exe or at.exe to add and modify task schedules 51->159 161 Uses powercfg.exe to modify the power settings 51->161 73 2 other processes 51->73 75 3 other processes 53->75 65 conhost.exe 57->65         started        file16 signatures17 process18 process19 77 conhost.exe 59->77         started        79 conhost.exe 61->79         started        81 timeout.exe 61->81         started        83 conhost.exe 67->83         started        85 conhost.exe 67->85         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f0a55a8e0663453f3edf65ef50844fa1f4b161888842ac942f5bc7c4bd2ce02/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-13 00:24:48 UTC
File Type:
PE (Exe)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4fflkhamy2fh47n6zppkcce7ipuwfqyrcccvskc6w6hys6szyba._file
Verdict:
malicious
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:vidar botnet:1707 evasion infostealer spyware stealer upx
Link:
https://tria.ge/reports/221024-3yz5tsbaep/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Uses the VBS compiler for execution
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Stops running service(s)
UPX packed file
Modifies security service
RedLine
RedLine payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
Malware Config
C2 Extraction:
185.215.113.83:60722
https://t.me/slivetalks
https://c.im/@xinibin420
Unpacked files
SH256 hash:
d288503282ac5e4084c57e9b29f3a1fb4f0f519df3758932df056cb5ae885e94
MD5 hash:
5c11fe91d4eb85ea06c27e5efd664091
SHA1 hash:
93c3a985d0ff5ce2f36ac9a59034bf72e9e3fadb
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/b78aa79c-e17e-476e-be7e-058f01123aef/
SH256 hash:
2f0a55a8e0663453f3edf65ef50844fa1f4b161888842ac942f5bc7c4bd2ce02
MD5 hash:
89654707bfe291db19d82c1740ad2036
SHA1 hash:
1972b8287afb1e9cff4a1966145ceabd7181f3ca
Link:
https://www.unpac.me/results/b78aa79c-e17e-476e-be7e-058f01123aef/
Malware family:
RedLine.D
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2f0a55a8e066/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2f0a55a8e0663453f3edf65ef50844fa1f4b161888842ac942f5bc7c4bd2ce02

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:redline_win_generic
Create hunting rule
Author:_kphi
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323697/

Comments