MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 409f15acc9e425d5f0cd8f1c6820b44067b5628c60a3a58114db3abf1196215b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 409f15acc9e425d5f0cd8f1c6820b44067b5628c60a3a58114db3abf1196215b
SHA3-384 hash: 633c8855d3a4268cb4c3768cdf00028056fc14b8e09fbd3d2424479daac98896a4527e941fc7f193e950c02a20cca5aa
SHA1 hash: 19403b5800caa8d964dea24f81426d2a7f8e24b1
MD5 hash: 4df8dd40cea92fc437fbff1e6b1595ab
humanhash: robin-batman-tennessee-quiet
File name:Setup.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:602'112 bytes
First seen:2021-08-17 09:35:39 UTC
Last seen:2021-08-17 10:46:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:akIrKG5eA1GoYqqbnIXWkvmc7Ln9VWbO/cp:arKg136
Threatray 913 similar samples on MalwareBazaar
TLSH T1C4D41F18667FC015D1F7EAB12DDCA8BBC9A990E3644D793710A4633B4B91784EE0F0B9
Reporter Anonymous
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179925/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.972.10037.8076.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
DNS request
Creating a file
Sending a UDP request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a window
Using the Windows Management Instrumentation requests
Sending an HTTP GET request
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the Windows subdirectory
Connection attempt to an infection source
Stealing user critical data
Downloading the file
Sending an HTTP POST request to an infection source
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a3aae52b-e469-4330-87ec-b4f8b527d394
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/834238
Signature
.NET source code contains very large strings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 466669 Sample: Setup.exe Startdate: 17/08/2021 Architecture: WINDOWS Score: 100 68 2no.co 2->68 74 Multi AV Scanner detection for dropped file 2->74 76 Multi AV Scanner detection for submitted file 2->76 78 Yara detected RedLine Stealer 2->78 80 2 other signatures 2->80 10 Setup.exe 2 2->10         started        14 service.exe 2->14         started        signatures3 process4 dnsIp5 56 C:\Users\user\AppData\Local\...\Setup.exe.log, ASCII 10->56 dropped 88 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->88 90 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 10->90 17 Setup.exe 15 34 10->17         started        22 conhost.exe 10->22         started        24 Setup.exe 10->24         started        72 192.168.2.1 unknown unknown 14->72 58 C:\Windows\SysWOW64\TEMP\service.exe (copy), PE32 14->58 dropped 92 Multi AV Scanner detection for dropped file 14->92 26 cmd.exe 14->26         started        28 cmd.exe 14->28         started        file6 signatures7 process8 dnsIp9 62 a0570895.xsph.ru 141.8.192.58, 49724, 80 SPRINTHOSTRU Russian Federation 17->62 64 185.250.206.82, 21330, 49718, 49722 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 17->64 66 api.ip.sb 17->66 54 C:\Users\user\AppData\Local\Temp\rnd.exe, PE32 17->54 dropped 82 Tries to harvest and steal browser information (history, passwords, etc) 17->82 84 Tries to steal Crypto Currency Wallets 17->84 30 rnd.exe 2 17->30         started        34 conhost.exe 26->34         started        36 powershell.exe 26->36         started        38 conhost.exe 28->38         started        file10 signatures11 process12 file13 60 C:\Users\user\AppData\Local\...\service.exe, PE32 30->60 dropped 94 Multi AV Scanner detection for dropped file 30->94 40 cmd.exe 1 30->40         started        43 cmd.exe 1 30->43         started        signatures14 process15 signatures16 86 Uses schtasks.exe or at.exe to add and modify task schedules 40->86 45 powershell.exe 14 16 40->45         started        48 conhost.exe 40->48         started        50 conhost.exe 43->50         started        52 schtasks.exe 43->52         started        process17 dnsIp18 70 2no.co 88.99.66.31, 443, 49742, 49744 HETZNER-ASDE Germany 45->70
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/409f15acc9e425d5f0cd8f1c6820b44067b5628c60a3a58114db3abf1196215b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-17 09:36:12 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icprllgj4qs5l4gnr4ogqifuibt3kyummcr2laiu3m5l6emwefnq._file
Verdict:
malicious
Similar samples:
1b71992d5ab923b569673eda4156bda6e15e555d7dd178770304a046875fcc56
RedLineStealer
32cf0e4532d6617a76a22f45edfe5d10ecbaf10040cedffdb2cea5126b6ff053
RedLineStealer
46acacf187e8a69d513f46bf38d1bd9844a1f1ca682086306177129d306c50e3
RedLineStealer
61404199a4111027ee2a446703cc35319dfdd4468adebda3b03cc9336a22d0e6
RedLineStealer
6d29ddd1db4433550549bde368bc857f62c9c008d85ccd387250e456ad479b98
RedLineStealer
76df849a6619dd5fc0ef798e4a9d48c864ddc84f3cac9c2093c807f4650a1ad8
RedLineStealer
9af2474823d8274925ccbc39726f4766c675c3e996dedfbbb6a4b07d86af6fe7
RedLineStealer
a0039d484f3134cad7e173c2bee0e089982b881711d99e19d61229b4854e02a5
RedLineStealer
c6434a502010b50f0ddd34e5ba9f57f2e98ac89670a212ddf74dd761b5a66239
RedLineStealer
+ 903 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@unityy1 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210817-3lc4g9jrej/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.250.206.82:21330
Unpacked files
SH256 hash:
73ced7b4a3f31c5932690b63988180573c6a320857581fabdf80b7df4f69168f
MD5 hash:
2409b0177beaeca2a282935ace2f5f5c
SHA1 hash:
20dc059a9120d44caa7cd14587c5d1350e0f5c7e
Link:
https://www.unpac.me/results/80609b83-ba11-4053-b59b-1154cc7d8364/
SH256 hash:
409f15acc9e425d5f0cd8f1c6820b44067b5628c60a3a58114db3abf1196215b
MD5 hash:
4df8dd40cea92fc437fbff1e6b1595ab
SHA1 hash:
19403b5800caa8d964dea24f81426d2a7f8e24b1
Link:
https://www.unpac.me/results/80609b83-ba11-4053-b59b-1154cc7d8364/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/409f15acc9e4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/409f15acc9e425d5f0cd8f1c6820b44067b5628c60a3a58114db3abf1196215b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179925/

Comments