MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36116d07ad4152300e4e6a61df0301f5531b3d641861d3f1ff163597f826e8d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36116d07ad4152300e4e6a61df0301f5531b3d641861d3f1ff163597f826e8d8
SHA3-384 hash: 9c23df36b84e648aa9d9cdd3bd62f6bcef4356c210977c00813857cb800bd485b2259dbb09beffffe7c7131ff5360252
SHA1 hash: d508f5f69db094d45993459a5b56710c1b78848b
MD5 hash: aa78bd736f4bd9dbb76aed95e3ddba67
humanhash: seventeen-india-florida-orange
File name:aa78bd736f4bd9dbb76aed95e3ddba67.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'855'240 bytes
First seen:2022-04-18 08:41:24 UTC
Last seen:2022-04-20 10:24:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5a498eee87e4d89512a84502f500181f (138 x AveMariaRAT, 57 x RedLineStealer, 7 x CoinMiner)
ssdeep 49152:a46Dxz2d/Lt7Bz02lnn+eVu18meeDsL9uyr7nxd60G9:5bp7108n+eVu6ksLNRd6H
Threatray 3'551 similar samples on MalwareBazaar
TLSH T1F685BFE38752020AE06BB03A901E6E2D7172063157CFB8B7B78DABF9931B2D0551DB57
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4505/5/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
46.8.19.98:8124

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
46.8.19.98:8124 https://threatfox.abuse.ch/ioc/520832/

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/264298/
Detection(s):
Win.Malware.Fragtor-9943711-0
Create hunting rule

Win.Packed.Lazy-9944324-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
Launching a process
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
DNS request
Creating a file in the %temp% directory
Creating a process from a recently created file
Stealing user critical data
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/625d245d482f2f41cac96d61/reports/5ac1f146-aec2-4cfb-b0a8-1605ae614179/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/45b4172d-b50d-4aef-a630-9c25114a1e83
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/978119
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 610606 Sample: zw6L3BPuLG.exe Startdate: 18/04/2022 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 4 other signatures 2->50 9 zw6L3BPuLG.exe 1 2->9         started        process3 signatures4 64 Writes to foreign memory regions 9->64 66 Allocates memory in foreign processes 9->66 68 Injects a PE file into a foreign processes 9->68 12 AppLaunch.exe 15 7 9->12         started        17 conhost.exe 9->17         started        process5 dnsIp6 38 46.8.19.98, 49733, 8124 ASKONTELRU Russian Federation 12->38 40 github.com 140.82.121.3, 443, 49741, 49748 GITHUBUS United States 12->40 42 raw.githubusercontent.com 185.199.108.133, 443, 49742 FASTLYUS Netherlands 12->42 34 C:\Users\user\AppData\Local\Temp\cheat.exe, PE32 12->34 dropped 70 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->70 72 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 12->72 74 Tries to harvest and steal browser information (history, passwords, etc) 12->74 76 Tries to steal Crypto Currency Wallets 12->76 19 cheat.exe 14 501 12->19         started        file7 signatures8 process9 dnsIp10 36 github.com 19->36 52 Antivirus detection for dropped file 19->52 54 Multi AV Scanner detection for dropped file 19->54 56 Obfuscated command line found 19->56 58 2 other signatures 19->58 23 cmd.exe 1 19->23         started        signatures11 process12 signatures13 60 Obfuscated command line found 23->60 62 Adds a directory exclusion to Windows Defender 23->62 26 powershell.exe 25 23->26         started        28 conhost.exe 23->28         started        30 chcp.com 1 23->30         started        32 2 other processes 23->32 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36116d07ad4152300e4e6a61df0301f5531b3d641861d3f1ff163597f826e8d8/
Threat name:
Win32.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2022-04-16 14:47:00 UTC
File Type:
PE (Exe)
AV detection:
26 of 42 (61.90%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gyiw2b5nifjdadsonjq56ayb6vjrwpledbq5h4p7cy2zp6bg5dma._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1b6db2ff76f4564310210b20e13118f37c92e1ef46541b1aec6b5a98be598ae4
RedLineStealer
2b5b9567b52c9d3a03d4d104b6dd965934233aa736cae0f8487bd4bb59dc19b2
RedLineStealer
353d580b05304e6fecbf52fab5b92d6024519fced8dd0e49ef601ed831559e26
RedLineStealer
a5453a830d01639ad537320c94e68565341328c872a8f2d3456221a0bec6f3e9
RedLineStealer
be1b5944f22b04374338b38f5abb922a0ea51a01305e2fdf5ef6c34a3dc026a5
RedLineStealer
f07786ba3a53d71ec02507c367ef19734e46ed796d52007a2d12f00780b3675b
RedLineStealer
+ 3'541 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer persistence spyware
Link:
https://tria.ge/reports/220418-kl1lqacag4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
46.8.19.98:8124
Unpacked files
SH256 hash:
fc0c2f6725be0412262b4e1a82a871af8a9b7bde0ca614fdffdc7829857a0d94
MD5 hash:
04f8768777447387035199e1bc4efb4e
SHA1 hash:
f506cb52054fa2829ee5e0fb89d64b0305826ff6
Link:
https://www.unpac.me/results/71e56385-9963-4b30-8025-161c35ae267a/
SH256 hash:
36116d07ad4152300e4e6a61df0301f5531b3d641861d3f1ff163597f826e8d8
MD5 hash:
aa78bd736f4bd9dbb76aed95e3ddba67
SHA1 hash:
d508f5f69db094d45993459a5b56710c1b78848b
Link:
https://www.unpac.me/results/71e56385-9963-4b30-8025-161c35ae267a/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/36116d07ad41/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/36116d07ad4152300e4e6a61df0301f5531b3d641861d3f1ff163597f826e8d8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/264298/

Comments