MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30
SHA3-384 hash: c1a8c533ae1157b918a7fab0ab01781bfab7516a8dae659c2bfdf4270a3d1c407dc2af77b4b8690b67d9e550d4582fa0
SHA1 hash: 52ae1e21101a216b8452806a4b731e9a53548549
MD5 hash: 82690f160f8a50e58d1620e91450637e
humanhash: freddie-finch-batman-hotel
File name:82690f160f8a50e58d1620e91450637e
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'613'696 bytes
First seen:2021-12-31 13:11:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c284fa365c4442728ac859c0f9ed4dc5 (94 x RedLineStealer, 10 x RaccoonStealer, 8 x CoinMiner)
ssdeep 98304:z3UFXGaPqJIcuDOzOfJCoNKp2BO/6HxcEFQR:O7PqJI1D7fJRwH8cEFQR
Threatray 492 similar samples on MalwareBazaar
TLSH T1C0F5336AC9D0394ED4CEC9BC720A6B4B3140D1F9CDE4216F91A9AB0BC1E92F59F18593
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
82690f160f8a50e58d1620e91450637e
Verdict:
Malicious activity
Analysis date:
2021-12-31 13:13:41 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/5b57b09e-856c-4feb-a697-b106fbe384e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216939/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Dropper.Asprotect-9919294-0
Create hunting rule

Win.Packed.Generickdz-9919439-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Сreating synchronization primitives
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61cf01ac8991ba72b3a2068f/reports/5262f16b-2935-4ede-9fa9-cc844b5ea973/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2d111d05-0c92-42a4-98bc-6263dd557f15
Result
Threat name:
BitCoin Miner RedLine SilentXMRMiner
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/914313
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Yara detected SilentXMRMiner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546791 Sample: 3el53P37FZ Startdate: 31/12/2021 Architecture: WINDOWS Score: 100 90 Found malware configuration 2->90 92 Multi AV Scanner detection for submitted file 2->92 94 Yara detected SilentXMRMiner 2->94 96 6 other signatures 2->96 13 3el53P37FZ.exe 2->13         started        16 vhsjuttyh.exe 2->16         started        process3 signatures4 136 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 13->136 138 Writes to foreign memory regions 13->138 140 Allocates memory in foreign processes 13->140 142 Injects a PE file into a foreign processes 13->142 18 AppLaunch.exe 15 7 13->18         started        144 Multi AV Scanner detection for dropped file 16->144 146 Creates a thread in another existing process (thread injection) 16->146 23 conhost.exe 5 16->23         started        process5 dnsIp6 84 95.143.178.139, 49766, 9006 RHTEC-ASrh-tecIPBackboneDE Russian Federation 18->84 86 cdn.discordapp.com 162.159.130.233, 443, 49768 CLOUDFLARENETUS United States 18->86 80 C:\Users\user\AppData\Local\Temp\8.exe, PE32+ 18->80 dropped 106 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->106 108 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 18->108 110 Tries to harvest and steal browser information (history, passwords, etc) 18->110 112 Tries to steal Crypto Currency Wallets 18->112 25 8.exe 18->25         started        82 C:\Windows\System32\...\sihost32.exe, PE32+ 23->82 dropped 114 Drops executables to the windows directory (C:\Windows) and starts them 23->114 116 Adds a directory exclusion to Windows Defender 23->116 28 sihost32.exe 23->28         started        30 cmd.exe 1 23->30         started        file7 signatures8 process9 signatures10 120 Multi AV Scanner detection for dropped file 25->120 122 Writes to foreign memory regions 25->122 124 Allocates memory in foreign processes 25->124 32 conhost.exe 4 25->32         started        126 Creates a thread in another existing process (thread injection) 28->126 36 conhost.exe 28->36         started        128 Adds a directory exclusion to Windows Defender 30->128 38 conhost.exe 30->38         started        40 powershell.exe 30->40         started        42 powershell.exe 30->42         started        process11 file12 78 C:\Windows\System32\vhsjuttyh.exe, PE32+ 32->78 dropped 88 Adds a directory exclusion to Windows Defender 32->88 44 cmd.exe 1 32->44         started        47 cmd.exe 1 32->47         started        49 cmd.exe 1 32->49         started        signatures13 process14 signatures15 130 Drops executables to the windows directory (C:\Windows) and starts them 44->130 51 vhsjuttyh.exe 44->51         started        54 conhost.exe 44->54         started        132 Uses schtasks.exe or at.exe to add and modify task schedules 47->132 134 Adds a directory exclusion to Windows Defender 47->134 56 powershell.exe 20 47->56         started        58 conhost.exe 47->58         started        60 powershell.exe 47->60         started        62 conhost.exe 49->62         started        64 schtasks.exe 1 49->64         started        process16 signatures17 100 Writes to foreign memory regions 51->100 102 Allocates memory in foreign processes 51->102 104 Creates a thread in another existing process (thread injection) 51->104 66 conhost.exe 51->66         started        process18 signatures19 98 Adds a directory exclusion to Windows Defender 66->98 69 cmd.exe 66->69         started        process20 signatures21 118 Adds a directory exclusion to Windows Defender 69->118 72 conhost.exe 69->72         started        74 powershell.exe 69->74         started        76 powershell.exe 69->76         started        process22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-12-29 16:08:47 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ittbeb35neipzv2sjrwioau275riilxpa5pq2ydbz5fyjjtx34ya._file
Verdict:
malicious
Similar samples:
0dee20eae747781c183499abc341feded87a5a6325f0a9b789067d1b6377ef89
RedLineStealer
1701171f89917e432739335ca3db9960f49bf7616a3832b4951df3215ceb0334
RedLineStealer
29c21dfbd286de4e1ef151053a40b5de880607c0edf38f5b77a5721b1342bb61
RedLineStealer
3d030fbfbe328bc4f276d565854f89189094ddb46dc1c6d36e8e9a438227279f
RedLineStealer
7387dda5e2f645e2bdb9c2b366b4917a52a0535800580deb50f28e6790418ec9
RedLineStealer
a9eb984c9de2d2d061babaaec8c15a04895af2cc0653d044f7092ba73013da5b
RedLineStealer
ac8bc27c6868bbb4b617b4280d8e400e6c9dda52c3ffda8a5603fe378374f69e
RedLineStealer
ade44175f9769fe9eb39588ce0d33707f75ea44ea15cb1e7823ff49725ac24aa
RedLineStealer
c3ce14cd6129b778bf9aeb26799fa3387e122cede177d2b85f85fea9af5ff6cc
RedLineStealer
cd716a11679b98b42382e72283c0fa785d8a4b041bee8044a2c7dffae2142446
RedLineStealer
+ 482 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211231-qfjc5sghf9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
bf29ca48bae60635d96fda5dc04bfb00d440d4a61cd9d05d49e7843cfc1310a2
MD5 hash:
1e0c7ee6e32ceffffdd57dbb82a3ee50
SHA1 hash:
d86a872f915df2baaba74c30726672fc3d182d5b
Link:
https://www.unpac.me/results/d36443f7-7ced-4cd5-9514-30e6d3c13f51/
SH256 hash:
74be0ffc5a8a0c3667b11525c4d3d280bb66a0269ef4eca0c79e71bb24c6b8c4
MD5 hash:
538dff361c90937ed0bf97a7f98945e8
SHA1 hash:
6d58e066180ea5f2c8b09ceb52470fa442d12f03
Link:
https://www.unpac.me/results/d36443f7-7ced-4cd5-9514-30e6d3c13f51/
SH256 hash:
44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30
MD5 hash:
82690f160f8a50e58d1620e91450637e
SHA1 hash:
52ae1e21101a216b8452806a4b731e9a53548549
Link:
https://www.unpac.me/results/d36443f7-7ced-4cd5-9514-30e6d3c13f51/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/44e612077d69/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1938766/
Cape
Cape
https://www.capesandbox.com/analysis/216939/

Comments


Avatar
zbet commented on 2021-12-31 13:11:44 UTC

url : hxxp://data-host-coin-8.com/files/5569_1640714939_7983.exe