MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 482321570b1fc0a7bfb77d4cf59efc3762b79033956cb146e345b07dca1549d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 482321570b1fc0a7bfb77d4cf59efc3762b79033956cb146e345b07dca1549d1
SHA3-384 hash: f45f21cd4e4b835004c7baee5b189e7e3541602fedb2c8b15032d9d454ebb462c973e00261a95e07430036c0fab9c51f
SHA1 hash: 3f90a6ae77c7270beb54c2040c73a2541ba07b3d
MD5 hash: 8ed81efa02f6f7699bb91e256e58e13b
humanhash: jupiter-network-leopard-connecticut
File name:8ED81EFA02F6F7699BB91E256E58E13B.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'223'160 bytes
First seen:2021-07-26 04:45:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 79 x RedLineStealer)
ssdeep 24576:yym337Z+zEEA2fOvJHVXNP4BBUeJWFc3Y0LU7f:yyg37OEKOhHpNPZeJ8c3YQg
TLSH T15A4533EA86304C05CDB43FB7A46417251D74EB523B94C39F2427E0E2CDF66E495AB172
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.67.231.194:29525

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.67.231.194:29525 https://threatfox.abuse.ch/ioc/162886/

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8ED81EFA02F6F7699BB91E256E58E13B.exe
Verdict:
Malicious activity
Analysis date:
2021-07-26 04:46:51 UTC
Tags:
trojan rat redline stealer autoit
Link:
https://app.any.run/tasks/53c5fdb2-8e1b-49b0-85ca-b048b76b1560

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/174056/
Detection(s):
Win.Malware.Agen-9864859-0
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
DNS request
Connection attempt
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Reading critical registry keys
Deleting a recently created file
Creating a file
Connection attempt to an infection source
Stealing user critical data
Sending an HTTP POST request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aabdec86-bd31-4244-9dee-05b1f09558b4
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/821611
Signature
Connects to many ports of the same IP (likely port scanning)
Contains functionality to register a low level keyboard hook
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files with a suspicious file extension
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file has nameless sections
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Submitted sample is a known malware sample
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 454023 Sample: vMmR7qTw8q.exe Startdate: 26/07/2021 Architecture: WINDOWS Score: 100 80 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->80 82 Found malware configuration 2->82 84 Multi AV Scanner detection for submitted file 2->84 86 7 other signatures 2->86 11 vMmR7qTw8q.exe 16 37 2->11         started        16 kAawPRZBwE.exe.com 1 2->16         started        18 wscript.exe 2->18         started        process3 dnsIp4 66 45.67.231.194, 29525, 49714, 49722 SERVERIUS-ASNL Moldova Republic of 11->66 68 amexomhospitality.com 91.211.249.8, 443, 49726 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 11->68 72 2 other IPs or domains 11->72 58 C:\Users\user\AppData\Roaming\12.exe, PE32 11->58 dropped 60 C:\Users\user\AppData\...\vMmR7qTw8q.exe.log, ASCII 11->60 dropped 108 Detected unpacking (changes PE section rights) 11->108 110 Detected unpacking (overwrites its own PE header) 11->110 112 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->112 120 5 other signatures 11->120 20 12.exe 7 11->20         started        70 ZqHgYEOdcYUYhuUpTCOAaZwJulmEh.ZqHgYEOdcYUYhuUpTCOAaZwJulmEh 16->70 62 C:\Users\user\AppData\Roaming\...\RegAsm.exe, PE32 16->62 dropped 114 Writes to foreign memory regions 16->114 116 Injects a PE file into a foreign processes 16->116 23 RegAsm.exe 16->23         started        118 Creates processes via WMI 18->118 file5 signatures6 process7 signatures8 88 Multi AV Scanner detection for dropped file 20->88 90 Contains functionality to register a low level keyboard hook 20->90 25 cmd.exe 1 20->25         started        process9 signatures10 92 Submitted sample is a known malware sample 25->92 94 Obfuscated command line found 25->94 96 Uses ping.exe to sleep 25->96 98 Uses ping.exe to check the status of other devices and networks 25->98 28 cmd.exe 3 25->28         started        31 conhost.exe 25->31         started        process11 signatures12 104 Obfuscated command line found 28->104 106 Uses ping.exe to sleep 28->106 33 Rivederla.exe.com 28->33         started        36 findstr.exe 1 28->36         started        39 PING.EXE 1 28->39         started        process13 file14 78 Drops PE files with a suspicious file extension 33->78 41 Rivederla.exe.com 7 33->41         started        50 C:\Users\user\AppData\...\Rivederla.exe.com, Targa 36->50 dropped signatures15 process16 dnsIp17 64 ZqHgYEOdcYUYhuUpTCOAaZwJulmEh.ZqHgYEOdcYUYhuUpTCOAaZwJulmEh 41->64 52 C:\Users\user\AppData\...\kAawPRZBwE.exe.com, PE32 41->52 dropped 54 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 41->54 dropped 56 C:\Users\user\AppData\...\kAawPRZBwE.url, MS 41->56 dropped 100 Writes to foreign memory regions 41->100 102 Injects a PE file into a foreign processes 41->102 46 RegAsm.exe 41->46         started        file18 signatures19 process20 dnsIp21 74 eth0.me 5.132.162.27, 49744, 80 INTERNEX-ASAT Austria 46->74 76 35.245.205.70, 15647, 49743 GOOGLEUS United States 46->76 122 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 46->122 124 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 46->124 126 Tries to harvest and steal browser information (history, passwords, etc) 46->126 128 Queries memory information (via WMI often done to detect virtual machines) 46->128 signatures22
Gathering data
Threat name:
Win32.Packed.EnigmaProtector
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 00:33:58 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jarscvyld7akpp5xpvgplhx4g5rlpebtsvwlcrxdiwyh3sqvjhiq._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer suricata
Link:
https://tria.ge/reports/210726-bt47p8y1q2/
Behaviour
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
suricata: ET MALWARE Arechclient2 Backdoor CnC Init
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
Unpacked files
SH256 hash:
482321570b1fc0a7bfb77d4cf59efc3762b79033956cb146e345b07dca1549d1
MD5 hash:
8ed81efa02f6f7699bb91e256e58e13b
SHA1 hash:
3f90a6ae77c7270beb54c2040c73a2541ba07b3d
Link:
https://www.unpac.me/results/a5382f60-a8fd-4306-8a59-b60f55b713f9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/482321570b1fc0a7bfb77d4cf59efc3762b79033956cb146e345b07dca1549d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:Enigma_Protected_Malware
Create hunting rule
Author:Florian Roth with the help of binar.ly
Description:Detects samples packed by Enigma Protector
Reference:https://goo.gl/OEVQ9w
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_mem
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8/
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.smominru.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/174056/

Comments