MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d2d9b8e5738024ffaa470410dfae954d73f049fdb2619be6864e399f3da6390. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d2d9b8e5738024ffaa470410dfae954d73f049fdb2619be6864e399f3da6390
SHA3-384 hash: 8d3cf808118bd04b38937f518ce556adaf095bbf0335d192b14c9b03a43ab517da063e41af20e21236286265cb843d4b
SHA1 hash: 013f45a5482aeedf10e17b28fd56c865a400a235
MD5 hash: 98ebbba527b85218e939eebecaabff44
humanhash: coffee-charlie-cold-paris
File name:98ebbba527b85218e939eebecaabff44.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:980'480 bytes
First seen:2020-07-19 09:33:39 UTC
Last seen:2020-07-19 11:11:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 17a9323ceec7e60993fa67c3b5e8f267 (2 x RedLineStealer)
ssdeep 24576:vJ7YXFiVI4Bw9P7Ax7H+jMwRzvb0caYPYkM:vJ06IRzNjVFb03W
TLSH 1B252222FC91CC31EB5A43704943C2B2CA9ABC784D7597D73B99476E8F746C2DB0A264
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://45.67.229.57:81/IRemotePanel

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27765/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/389685
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247016 Sample: YLx1BkO4Di.exe Startdate: 19/07/2020 Architecture: WINDOWS Score: 72 27 Yara detected RedLine Stealer 2->27 29 Yara detected MSIL Crypter 2->29 31 Machine Learning detection for sample 2->31 33 Found many strings related to Crypto-Wallets (likely being stolen) 2->33 8 YLx1BkO4Di.exe 1 2->8         started        process3 file4 23 C:\Users\user\AppData\...\YLx1BkO4Di.exe.log, ASCII 8->23 dropped 35 Detected unpacking (overwrites its own PE header) 8->35 12 RegAsm.exe 15 2 8->12         started        signatures5 process6 dnsIp7 25 45.67.229.57, 81 ALEXHOSTMD Moldova Republic of 12->25 15 cmd.exe 1 12->15         started        process8 process9 17 taskkill.exe 1 15->17         started        19 conhost.exe 15->19         started        21 choice.exe 1 15->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d2d9b8e5738024ffaa470410dfae954d73f049fdb2619be6864e399f3da6390/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-07-19 09:35:06 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=huwzxdsxhabe76veobaq36xjktlt6be73mtbtptimtrzt462moia._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/200719-qnba6msglj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of SetThreadContext
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d2d9b8e5738024ffaa470410dfae954d73f049fdb2619be6864e399f3da6390

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 3d2d9b8e5738024ffaa470410dfae954d73f049fdb2619be6864e399f3da6390

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/408894/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/27765/

Comments