MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46568a18ee0442990b28d41b4a9c8a96ee257eb85fd22ea6ab9f8325d6f30f7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46568a18ee0442990b28d41b4a9c8a96ee257eb85fd22ea6ab9f8325d6f30f7b
SHA3-384 hash: f7b6dffe221a5eaf42b482974e0bfedcd7f89cda324d507efd54775fda8e336391c7279fcbe89f318cc9ba9ee3a616cf
SHA1 hash: 9b613f8d6b67a88e71af2ae3f10123879c3a11df
MD5 hash: 4c9ae2fb5b36e10cbeeb3d0b00854c3f
humanhash: princess-chicken-arizona-seventeen
File name:4c9ae2fb5b36e10cbeeb3d0b00854c3f.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'484'253 bytes
First seen:2022-01-12 07:29:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 760fd261ec10f8a22c61d2a2c4d2af7d (3 x RedLineStealer, 1 x CryptBot)
ssdeep 49152:qqMHpDU0DMTOcDWwB4FZqxq/+mVTGotQmfXD3A5RbzBHQxiz8lVHTIioOFZQ+7:qqYU2ct4FZJrDPD3A/blHQxiqZ77
TLSH T117B533167FEAC8B1C16D127008968E93EFBDE7700F9482DBAB541D151861BE8DB7E243
File icon (PE):PE icon
dhash icon eaa1a5a5a3bec080 (2 x AsyncRAT, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4c9ae2fb5b36e10cbeeb3d0b00854c3f.exe
Verdict:
Suspicious activity
Analysis date:
2022-01-12 07:36:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dfc11b97-b945-41dc-9150-b700ce2e876b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/218569/
Detection(s):
Win.Trojan.Coinminer-9835184-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Replacing files
Enabling the 'hidden' option for files in the %temp% directory
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/387c9907-fe53-49ed-bc38-1fec00db300a
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/918982
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 551466 Sample: JtlBbNOKVK.exe Startdate: 12/01/2022 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Antivirus detection for dropped file 2->42 44 Yara detected RedLine Stealer 2->44 46 3 other signatures 2->46 8 JtlBbNOKVK.exe 7 2->8         started        process3 file4 32 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 8->32 dropped 34 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 8->34 dropped 48 Contains functionality to register a low level keyboard hook 8->48 12 cmd.exe 2 8->12         started        signatures5 process6 process7 14 Et0qHSv0en3EbwT.exe 1 12->14         started        17 7z.exe 2 12->17         started        20 7z.exe 3 12->20         started        22 12 other processes 12->22 file8 58 Contains functionality to inject code into remote processes 14->58 60 Writes to foreign memory regions 14->60 62 Allocates memory in foreign processes 14->62 64 2 other signatures 14->64 24 RegSvcs.exe 15 5 14->24         started        28 conhost.exe 14->28         started        30 C:\Users\user\AppData\...t0qHSv0en3EbwT.exe, PE32 17->30 dropped signatures9 process10 dnsIp11 36 193.150.103.37, 49787, 81 ASGENERALTELRU Russian Federation 24->36 38 api.ip.sb 24->38 50 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 24->50 52 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 24->52 54 Tries to harvest and steal browser information (history, passwords, etc) 24->54 56 Tries to steal Crypto Currency Wallets 24->56 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46568a18ee0442990b28d41b4a9c8a96ee257eb85fd22ea6ab9f8325d6f30f7b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-01-12 07:30:15 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware
Link:
https://tria.ge/reports/220112-jbtjzsbff5/
Behaviour
Views/modifies file attributes
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
c9ed793e5c126686239b1df363526fa5ca5181694e5f4ca9e1e22f453487c84d
MD5 hash:
e6e317e5485f6121c554b1b22a2a5819
SHA1 hash:
39c9e4adcc5e72f9851edf40ae55480cfaeaef9d
Link:
https://www.unpac.me/results/f2536f18-dcd3-43ae-9768-b2e4dc437179/
SH256 hash:
46568a18ee0442990b28d41b4a9c8a96ee257eb85fd22ea6ab9f8325d6f30f7b
MD5 hash:
4c9ae2fb5b36e10cbeeb3d0b00854c3f
SHA1 hash:
9b613f8d6b67a88e71af2ae3f10123879c3a11df
Link:
https://www.unpac.me/results/f2536f18-dcd3-43ae-9768-b2e4dc437179/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/46568a18ee04/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.04
Link:
https://yomi.yoroi.company/submissions/46568a18ee0442990b28d41b4a9c8a96ee257eb85fd22ea6ab9f8325d6f30f7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 46568a18ee0442990b28d41b4a9c8a96ee257eb85fd22ea6ab9f8325d6f30f7b

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/218569/
  
URLhaus
https://urlhaus.abuse.ch/url/1971875/
  
Delivery method
Distributed via web download

Comments