MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027
SHA3-384 hash: f77683ea5395d00fdb5121e72ec9b5b8cc461d80a41da738bc5a0030b16c7a2274095c90270fa42d4efe5a91a765daf4
SHA1 hash: 0827d6ae76e2b6e479427cb036ec28cf6514b07d
MD5 hash: a802432a199beeb33123eef566f3073e
humanhash: edward-music-india-east
File name:a802432a199beeb33123eef566f3073e.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'941'824 bytes
First seen:2021-10-01 12:32:29 UTC
Last seen:2021-10-01 14:18:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 98304:9TC0xRAZrrATYZT4upPbNS2AobiYkVmvZ9FFdk+YH:hVmsT44upNSSuYcmvZ9FF6NH
Threatray 2'593 similar samples on MalwareBazaar
TLSH T14B36EF0049B4D6E9AB15AF6EC6EEFA4F498F7B2339416EC51D207B719F403C466E240B
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
193.203.203.82:63851

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.203.203.82:63851 https://threatfox.abuse.ch/ioc/229489/

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a802432a199beeb33123eef566f3073e.exe
Verdict:
Malicious activity
Analysis date:
2021-10-01 19:44:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a6c97563-bd05-465b-bc87-e03beb03d512

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Vidar
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193989/
Detection(s):
SecuriteInfo.com.Trojan.MulDropNET.43.26813.31186.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a window
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/44272f49-6047-489a-9bc4-ca97d1d30d3e
Result
Threat name:
BitCoin Miner RedLine Vidar Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/862707
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contain functionality to detect virtual machines
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Drops PE files with a suspicious file extension
Found malware configuration
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Yara detected Vidar
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 495135 Sample: 82Iqbsw9vI.exe Startdate: 01/10/2021 Architecture: WINDOWS Score: 100 70 ip-api.com 208.95.112.1, 49694, 80 TUT-ASUS United States 2->70 72 94.140.112.88 TELEMACHBroadbandAccessCarrierServicesSI Latvia 2->72 74 12 other IPs or domains 2->74 112 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->112 114 Found malware configuration 2->114 116 Malicious sample detected (through community Yara rule) 2->116 118 23 other signatures 2->118 9 82Iqbsw9vI.exe 13 2->9         started        12 services64.exe 2->12         started        signatures3 process4 file5 40 C:\Users\user\AppData\...\sfx_123_206.exe, PE32 9->40 dropped 42 C:\Users\user\AppData\Local\Temp\setup.exe, PE32 9->42 dropped 44 C:\Users\user\AppData\Local\Temp\jhuuee.exe, PE32+ 9->44 dropped 46 9 other files (7 malicious) 9->46 dropped 14 DownFlSetup110.exe 16 7 9->14         started        19 Chrome 5.exe 5 9->19         started        21 inst3.exe 9->21         started        23 3 other processes 9->23 process6 dnsIp7 82 onepremiumstore.bar 104.21.42.252, 443, 49686, 49687 CLOUDFLARENETUS United States 14->82 84 iplogger.org 14->84 86 auto-repair-solutions.bar 14->86 52 C:\Users\user\AppData\Roaming\8692672.scr, PE32 14->52 dropped 54 C:\Users\user\AppData\Roaming\7337695.scr, PE32 14->54 dropped 56 C:\Users\user\AppData\Roaming\6676490.scr, PE32 14->56 dropped 58 C:\Users\user\AppData\Roaming\3830771.scr, PE32 14->58 dropped 94 Detected unpacking (changes PE section rights) 14->94 96 May check the online IP address of the machine 14->96 98 Drops PE files with a suspicious file extension 14->98 25 7337695.scr 14->25         started        60 C:\Users\user\AppData\...\services64.exe, PE32+ 19->60 dropped 29 services64.exe 19->29         started        32 cmd.exe 1 19->32         started        100 Detected unpacking (creates a PE file in dynamic memory) 21->100 102 Machine Learning detection for dropped file 21->102 104 Contains functionality to infect the boot sector 21->104 110 2 other signatures 21->110 88 79.124.78.139, 49690, 80 VERDINABZ Bulgaria 23->88 90 gcl-page.biz 162.248.225.210, 49691, 80 HOSTING-SOLUTIONSUS United States 23->90 92 mas.to 88.99.75.82, 443, 49688 HETZNER-ASDE Germany 23->92 62 C:\Users\user\AppData\Local\...\Install.exe, PE32 23->62 dropped 64 C:\Users\user\AppData\Local\...\INSTAL~1.EXE, PE32 23->64 dropped 66 C:\Users\user\AppData\...\msvcp140[1].dll, PE32 23->66 dropped 68 11 other files (none is malicious) 23->68 dropped 106 Antivirus detection for dropped file 23->106 108 Detected unpacking (overwrites its own PE header) 23->108 34 Install.exe 4 23->34         started        file8 signatures9 process10 dnsIp11 76 the-lead-bitter.com 104.21.66.135, 443, 49705 CLOUDFLARENETUS United States 25->76 120 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 25->120 122 Tries to harvest and steal browser information (history, passwords, etc) 25->122 78 sanctam.net 185.65.135.234, 49692, 58899 ESAB-ASSE Sweden 29->78 80 bitbucket.org 104.192.141.1, 443, 49707 AMAZON-02US United States 29->80 48 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 29->48 dropped 50 C:\Users\user\AppData\...\sihost64.exe, PE32+ 29->50 dropped 124 Modifies the context of a thread in another process (thread injection) 29->124 126 Sample is not signed and drops a device driver 29->126 128 Injects a PE file into a foreign processes 29->128 130 Uses schtasks.exe or at.exe to add and modify task schedules 32->130 36 conhost.exe 32->36         started        38 schtasks.exe 32->38         started        132 Adds a directory exclusion to Windows Defender 34->132 file12 signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027/
Threat name:
ByteCode-MSIL.Backdoor.Mokes
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 16:36:42 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jd43jpbl65oagreyk77q222hynnls7wyxjceregm3vasrwnocatq._file
Verdict:
malicious
Similar samples:
13492a113107ae59e2fe02f3c3b9afa411a39caa73b78ea06dec0fb9a970f7a2
RedLineStealer
3b3af3c0c0ccff93c1f62d0e00a25e76b856392c604e209f93e987a7a913a727
RedLineStealer
4d04f5f44c21f9ccda28433bddea30ce2fba7a548d7d40a46332e0d2b70079d0
RedLineStealer
5ad7bfb790fc652df60360024af60578790930bb78489aabf352eae3fff103fb
RedLineStealer
908b275d6fc2f20e9d04e8609a9d994f7e88a429c3eb0a55d99ca1c681e17ec8
RedLineStealer
9dbdfabbc99542e1c94b7a29eaf437b7fa4c898c4add1a677b126257ae54f94e
RedLineStealer
a5ae0f12308cd01e02c8c75137818f8945f4fba0785f5558c75bff2f20fb7957
RedLineStealer
b3c5e36f9aa05f6af9a685e32fe3e979a92ce5c96d5be130e7145b62c3948650
RedLineStealer
ed6d502c7c263fd9bd28324f68b287aea158203d0c5154ca07a9bcd059aa2980
RedLineStealer
+ 2'583 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:redline family:vidar family:xmrig botnet:1 botnet:933 discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/211001-pq7caabgh6/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
XMRig Miner Payload
Process spawned unexpected child process
RedLine
RedLine Payload
Vidar
xmrig
Malware Config
C2 Extraction:
https://mas.to/@bardak1ho
193.203.203.82:63851
Unpacked files
SH256 hash:
48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027
MD5 hash:
a802432a199beeb33123eef566f3073e
SHA1 hash:
0827d6ae76e2b6e479427cb036ec28cf6514b07d
Link:
https://www.unpac.me/results/6b24a5f9-d99e-442e-a2cc-c531ac1fdcef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_CoinMiner02
Create hunting rule
Author:ditekSHen
Description:Detects coinmining malware
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:MAL_XMR_Miner_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:MAL_XMR_Miner_May19_1_RID2E1B
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/193989/

Comments