MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 411656602e3e13e8a41b73648d62aedc061b0c91a85c8b901ab04b1f735017cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 411656602e3e13e8a41b73648d62aedc061b0c91a85c8b901ab04b1f735017cb
SHA3-384 hash: 1f54a6a468f4a73ee6a974c3048468b2dc57e2eb53ec5adc2d1d4ec3a825bd4ae54d9ba9a7e828abff8c43db046ea4f8
SHA1 hash: 0f6319fa952fa613cc20b661c658f4f3fdd42a51
MD5 hash: 78b04004d3b77dbc698842308985321f
humanhash: mike-double-kansas-alabama
File name:78b04004d3b77dbc698842308985321f
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'561'472 bytes
First seen:2021-12-08 03:01:46 UTC
Last seen:2021-12-08 05:34:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d7dd6fa75115d9909f747434e40fff68 (173 x RedLineStealer, 10 x DCRat, 1 x CoinMiner.XMRig)
ssdeep 24576:chb8PegIVAdSo4CU2bYi+9kKSYeSop4l3+7MQrOf3crW0JemdFkEaHNYK36+K5Do:cx8Pegk+SoLnOPSYLouOAQCf3crW0Jen
Threatray 1'742 similar samples on MalwareBazaar
TLSH T15775339F0E40E917F6D359F0977498FFED1E4E3EBBB01047995EB606BB842149A83824
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
78b04004d3b77dbc698842308985321f
Verdict:
Malicious activity
Analysis date:
2021-12-08 03:04:02 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/b8717277-ebdc-43a0-9d6f-7d08dc43c9d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/212327/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Launching a process
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Stealing user critical data
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/1281/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61b0202d4d8e6f3a5e18796f/reports/a17612c1-4ffc-4307-9669-210a26418105/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fb3aa858-637f-44eb-9935-333a290ec284
Result
Threat name:
Phoenix Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/903591
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Phoenix Miner
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 536069 Sample: 02N6tmvMIl Startdate: 08/12/2021 Architecture: WINDOWS Score: 100 99 raw.githubusercontent.com 2->99 101 github.com 2->101 129 Antivirus detection for dropped file 2->129 131 Multi AV Scanner detection for dropped file 2->131 133 Yara detected Phoenix Miner 2->133 135 5 other signatures 2->135 11 02N6tmvMIl.exe 15 7 2->11         started        16 RegHost.exe 2->16         started        18 RegHost.exe 13 2->18         started        signatures3 process4 dnsIp5 117 byaigelevl.xyz 185.82.126.188, 49729, 80 MAKONIXLV Latvia 11->117 119 github.com 140.82.121.3, 443, 49743, 49760 GITHUBUS United States 11->119 125 2 other IPs or domains 11->125 93 C:\Users\user\AppData\Local\Temp\a.exe, PE32+ 11->93 dropped 95 C:\Users\user\AppData\...\02N6tmvMIl.exe.log, ASCII 11->95 dropped 153 Detected unpacking (changes PE section rights) 11->153 155 Detected unpacking (overwrites its own PE header) 11->155 157 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->157 169 4 other signatures 11->169 20 a.exe 1 22 11->20         started        121 140.82.121.4, 443, 49786, 49787 GITHUBUS United States 16->121 159 Query firmware table information (likely to detect VMs) 16->159 161 Writes to foreign memory regions 16->161 163 Allocates memory in foreign processes 16->163 171 2 other signatures 16->171 123 192.168.2.1 unknown unknown 18->123 165 Machine Learning detection for dropped file 18->165 167 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->167 25 cmd.exe 18->25         started        27 conhost.exe 18->27         started        file6 signatures7 process8 dnsIp9 103 185.199.108.133, 443, 49762, 49765 FASTLYUS Netherlands 20->103 105 raw.githubusercontent.com 20->105 107 github.com 20->107 85 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 20->85 dropped 87 C:\Users\user\AppData\Roaming\...\7z.exe, PE32+ 20->87 dropped 89 C:\Users\user\AppData\Roaming\...\7z.dll, PE32+ 20->89 dropped 91 2 other files (none is malicious) 20->91 dropped 137 Query firmware table information (likely to detect VMs) 20->137 139 Machine Learning detection for dropped file 20->139 141 Injects code into the Windows Explorer (explorer.exe) 20->141 143 6 other signatures 20->143 29 explorer.exe 20->29         started        31 cmd.exe 1 20->31         started        33 bfsvc.exe 20->33         started        40 3 other processes 20->40 36 conhost.exe 25->36         started        38 7z.exe 25->38         started        file10 signatures11 process12 signatures13 42 RegHost.exe 29->42         started        46 curl.exe 1 31->46         started        48 conhost.exe 31->48         started        127 Hides threads from debuggers 33->127 50 conhost.exe 33->50         started        52 7z.exe 2 40->52         started        55 7z.exe 40->55         started        57 conhost.exe 40->57         started        59 conhost.exe 40->59         started        process14 dnsIp15 109 185.199.109.133, 443, 49807, 49810 FASTLYUS Netherlands 42->109 111 raw.githubusercontent.com 42->111 113 github.com 42->113 145 Query firmware table information (likely to detect VMs) 42->145 147 Injects code into the Windows Explorer (explorer.exe) 42->147 149 Writes to foreign memory regions 42->149 151 4 other signatures 42->151 115 api.telegram.org 149.154.167.220, 443, 49753 TELEGRAMRU United Kingdom 46->115 61 bfsvc.exe 46->61         started        65 cmd.exe 46->65         started        67 cmd.exe 46->67         started        69 conhost.exe 46->69         started        81 C:\Users\user\AppData\...\RegHost_Temp.exe, PE32+ 52->81 dropped 83 C:\Users\user\AppData\...\RegData_Temp.exe, PE32+ 55->83 dropped file16 signatures17 process18 file19 97 \Device\ConDrv, ASCII 61->97 dropped 173 Hides threads from debuggers 61->173 71 conhost.exe 61->71         started        73 conhost.exe 65->73         started        75 7z.exe 65->75         started        77 conhost.exe 67->77         started        79 7z.exe 67->79         started        signatures20 process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/411656602e3e13e8a41b73648d62aedc061b0c91a85c8b901ab04b1f735017cb/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-12-07 19:47:41 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 27 (81.48%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ielfmybohyj6rja3onsi2yvo3qdbwdervboixea2wbfr642qc7fq._file
Verdict:
malicious
Similar samples:
30c40f127100a3d96bdb69ce93424228af279691046277adca4985c7a6b64468
RedLineStealer
37d60b726b9c02798258e9aa804dae183d538047a963af717e2a70f8c55f48cc
RedLineStealer
39f8595624535025d6a99bfe5e8619ee4ba1d5bc635d0432cebc885eac61b3ff
RedLineStealer
41eed12a51e9f070c161a1cedac0e5eaab85d7c82513d5d5d2e798a19bc4fceb
RedLineStealer
7e0150a3d7bbc38f40afa31e78a1e280954ccea8211f98f32e2c65ec96bde43c
RedLineStealer
8f5b85039bb231546bcea5c8962f44db81af9c292288beafc93216a932d50b12
RedLineStealer
94f8655a5751dd58930359931db8e0f3cc0cfe5145eb140b2b8778d9063dd3f0
RedLineStealer
a2a016786b8fe135450ba0580450df69d6c6a859f8ed980138db8d8c3fede92a
RedLineStealer
c29fd5dc571fc98e925f49c3f36549d4b805022a884af9be750849ce85d8392f
RedLineStealer
fe9b603aa67c0d7a86888ae88afa001f467e5566c7b05ce62263d392aaf92037
RedLineStealer
+ 1'732 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/211208-djgbqsegcr/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine Payload
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/08f58f18-1ae7-4c23-8407-31cacb895989/
SH256 hash:
411656602e3e13e8a41b73648d62aedc061b0c91a85c8b901ab04b1f735017cb
MD5 hash:
78b04004d3b77dbc698842308985321f
SHA1 hash:
0f6319fa952fa613cc20b661c658f4f3fdd42a51
Link:
https://www.unpac.me/results/08f58f18-1ae7-4c23-8407-31cacb895989/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/411656602e3e13e8a41b73648d62aedc061b0c91a85c8b901ab04b1f735017cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 411656602e3e13e8a41b73648d62aedc061b0c91a85c8b901ab04b1f735017cb

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1864650/
Cape
Cape
https://www.capesandbox.com/analysis/212327/

Comments


Avatar
zbet commented on 2021-12-08 03:01:47 UTC

url : hxxp://file-coin-data-5.com/files/1259_1638892552_21.exe