MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47c20f310c3a257ed787d9ea814dc272b1e40c8de9a532a82450c302d581a552. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47c20f310c3a257ed787d9ea814dc272b1e40c8de9a532a82450c302d581a552
SHA3-384 hash: c7e1ee6b3033c777e21183796ebf2feaa2bd8980d1fae833d42d31d84f75f7a6d3e5a4e950e288064fe5d5ae61b63b8e
SHA1 hash: 7fa33ccbd4c91d149f24380e894cfd00a2e89048
MD5 hash: b44fdfea59643100a58a66aab7705fd6
humanhash: summer-carbon-alanine-black
File name:b44fdfea59643100a58a66aab7705fd6.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'397'056 bytes
First seen:2022-01-01 12:15:49 UTC
Last seen:2022-01-01 13:30:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a4258c5d218cf6e5c500e8415d5f5ed (13 x RedLineStealer, 2 x RaccoonStealer)
ssdeep 98304:S9gEEZ4IciV04CXsp3Ao0GAU32oJHMzL+q+zrVkys3OHPyKlR4V:SiXwaTCcFT0DWHMuTxkyfvVl8
Threatray 129 similar samples on MalwareBazaar
TLSH T1251633B9A4ED7900E48C66F46C24BB4BF0261226F194D5A031F1677C0EAA7C3376DDB9
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.204.109.248:26250

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.204.109.248:26250 https://threatfox.abuse.ch/ioc/290343/

Intelligence

File Origin
# of uploads :
2
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b44fdfea59643100a58a66aab7705fd6.exe
Verdict:
Malicious activity
Analysis date:
2022-01-01 12:18:19 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/074d9910-9e17-4f01-a868-8ad5c8b74fcf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216999/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Launching the default Windows debugger (dwwin.exe)
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed yakes
Link:
https://www.filescan.io/uploads/61d046034ab5c44cbf5a65ee/reports/cc260bb7-0334-4a84-bead-7da36914fb10/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a7e5e828-3c07-405f-9306-f66a77ad256a
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/914453
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 546931 Sample: BcRHxjnP48.exe Startdate: 01/01/2022 Architecture: WINDOWS Score: 100 37 Found malware configuration 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected RedLine Stealer 2->41 43 4 other signatures 2->43 8 BcRHxjnP48.exe 2->8         started        process3 signatures4 45 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->45 47 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 8->47 49 Writes to foreign memory regions 8->49 51 3 other signatures 8->51 11 AppLaunch.exe 15 7 8->11         started        process5 dnsIp6 25 185.204.109.248, 26250, 49756 OWENTIS-ASFR Russian Federation 11->25 27 transfer.sh 144.76.136.153, 443, 49759 HETZNER-ASDE Germany 11->27 23 C:\Users\user\AppData\Local\Temp\123321.exe, PE32+ 11->23 dropped 53 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->53 55 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->55 57 Tries to harvest and steal browser information (history, passwords, etc) 11->57 59 Tries to steal Crypto Currency Wallets 11->59 16 123321.exe 1 11->16         started        file7 signatures8 process9 signatures10 29 Antivirus detection for dropped file 16->29 31 Multi AV Scanner detection for dropped file 16->31 33 Detected unpacking (overwrites its own PE header) 16->33 35 2 other signatures 16->35 19 WerFault.exe 20 9 16->19         started        21 conhost.exe 16->21         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47c20f310c3a257ed787d9ea814dc272b1e40c8de9a532a82450c302d581a552/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-12-30 00:32:47 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 43 (55.81%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7ba6mimhisx5v4h3hvictocoky6iden5gstfkbekdbqfvmbuvja._file
Verdict:
malicious
Similar samples:
06694768182079f742731e4bc2f6c0ffc012417020d04cd798cb8df4f8919f11
RedLineStealer
17be6c33020601127b2ac2e87be0dadb64c7af911d38ba70bf4d86d595ca4759
RedLineStealer
213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e
RedLineStealer
64edbaff99fe8c87c2f5f826b0d1741c575295e3ab0c3d16db8bbacd2baebd30
RedLineStealer
7ee9fb0abc60de5047fb5e85cafc5a05383978bb1653a8ae824437488238d611
RedLineStealer
9afaff96a502524fb2284ca961c5aa89533e9cd4c397a672d57331099803ebc6
RedLineStealer
b099b966cf59ae34f72150d3b49143a27c62decd8eb4d4ac38b86a85be78fb8d
RedLineStealer
f3de4ce2a7e7d27e8dcfc9b38b0e55631181393e673a37a57bd97e218a797cfe
RedLineStealer
+ 119 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220101-pff3cagbbq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
8e78bb22e21085a538d66a0fb1920ba5aa16f2589cf4a9d40c1319e02cc625de
MD5 hash:
601a571b74ab873713554971e80e5bed
SHA1 hash:
82c4117db295cbcb7fbd95ff83c4bce93f475622
Link:
https://www.unpac.me/results/9b8592cd-3843-4e19-8c88-91c04c18c1b9/
SH256 hash:
ea5404aaaa3d5a203b490fe89bcb339e56c7d6155b883180a44064fdde192fdc
MD5 hash:
2ee22fdd49462d5f6a70f3fb47e9bad8
SHA1 hash:
d1a3c7da13428e31cd7c26b805688f0fadaad041
Link:
https://www.unpac.me/results/9b8592cd-3843-4e19-8c88-91c04c18c1b9/
SH256 hash:
47c20f310c3a257ed787d9ea814dc272b1e40c8de9a532a82450c302d581a552
MD5 hash:
b44fdfea59643100a58a66aab7705fd6
SHA1 hash:
7fa33ccbd4c91d149f24380e894cfd00a2e89048
Link:
https://www.unpac.me/results/9b8592cd-3843-4e19-8c88-91c04c18c1b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47c20f310c3a257ed787d9ea814dc272b1e40c8de9a532a82450c302d581a552

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/216999/

Comments