MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4aa853c8b52d8846ca5593c6af59c6bcb925027b7227283cedebf97303ad7241. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4aa853c8b52d8846ca5593c6af59c6bcb925027b7227283cedebf97303ad7241
SHA3-384 hash: 718b1938287b5fa2af8d7905f955e8e2b6b3af6c325166fc4bcd6e07a3e8312452558a8f379217bc58cd5582aabb54e6
SHA1 hash: 42d2cfa6b5a4a3e3f2785a2d18d43c8c0f7c9f3e
MD5 hash: 7835486c4edc317ceeec1d761e66249f
humanhash: dakota-fish-one-bakerloo
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:5'220'200 bytes
First seen:2022-08-29 19:23:26 UTC
Last seen:2022-08-30 08:46:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 172750858dcc0719eed08c952858023c (117 x RedLineStealer, 3 x N-W0rm, 1 x AsyncRAT)
ssdeep 98304:D1G3orcO5/t390ihbftnKu2AoonlzLHxAlNHGnKlxgVX0wH/wu0S6M6LdFJ3ufv:DHrcO5/t390ihbft8GlzD+mn/EwH/iRI
TLSH T1423612B26260019EC0E68C358937FDF572B4162B6F436CB775C97DDA26325F0A223993
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon d4ec66cac966ecd4 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:Dell Alienware x15 R1 X15-9970) silver Core i7-11800H/32G/512G SSD 15 FHD IPS 360Hz AGNV RTX3080 8G
Issuer:Dell Alienware x15 R1 X15-9970) silver Core i7-11800H/32G/512G SSD 15 FHD IPS 360Hz AGNV RTX3080 8G
Algorithm:sha1WithRSAEncryption
Valid from:2022-08-28T15:48:37Z
Valid to:2032-08-29T15:48:37Z
Serial number: 5c88b3c539fdf5a94e319cc012765d80
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 416304decfc2482a42f324e949a9b589505859ae381df9e8377d9b511ffa8a49
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://www.6autumns.com/wp-content/uploads/2018/08/img/v28080.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
384
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-08-29 19:24:44 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/81b47c5e-585e-49c4-9331-33b796969575

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/302318/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.13326.21286.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
DNS request
Creating a file in the system32 subdirectories
Creating a file
Сreating synchronization primitives
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Enabling the 'hidden' option for files in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a recently created file
Replacing files
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm overlay packed
Link:
https://www.filescan.io/uploads/630d126d2fdf5a08259187dc/reports/87adebe0-faa1-4daa-b474-4d8433b79a2b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e6fb7368-f73e-452b-b709-940d3d06e8d9
Result
Threat name:
MinerDownloader, RedLine, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1060089
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Contains functionality to register a low level keyboard hook
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
PE file has nameless sections
Potential dropper URLs found in powershell memory
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Schedule system process
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Generic MinerDownloader
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 692606 Sample: file.exe Startdate: 29/08/2022 Architecture: WINDOWS Score: 100 68 pastebin.com 2->68 88 Snort IDS alert for network traffic 2->88 90 Multi AV Scanner detection for domain / URL 2->90 92 Malicious sample detected (through community Yara rule) 2->92 94 17 other signatures 2->94 11 file.exe 15 7 2->11         started        signatures3 process4 dnsIp5 76 morewallet.org 162.55.163.158, 49713, 81 ACPCA United States 11->76 78 api.ip.sb 11->78 80 37.139.129.226, 49725, 80 LVLT-10753US Germany 11->80 64 C:\Users\user\AppData\...\notification.exe, PE32 11->64 dropped 66 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 11->66 dropped 98 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->98 100 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->100 102 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->102 104 3 other signatures 11->104 16 notification.exe 8 11->16         started        file6 signatures7 process8 file9 52 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 16->52 dropped 54 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 16->54 dropped 82 Contains functionality to register a low level keyboard hook 16->82 20 cmd.exe 2 16->20         started        signatures10 process11 process12 22 alex.exe 14 31 20->22         started        27 7z.exe 2 20->27         started        29 7z.exe 3 20->29         started        31 4 other processes 20->31 dnsIp13 70 github.com 140.82.121.3, 443, 49741, 49742 GITHUBUS United States 22->70 72 raw.githubusercontent.com 185.199.109.133, 443, 49745, 49749 FASTLYUS Netherlands 22->72 74 pastebin.com 172.67.34.170, 443, 49731, 49760 CLOUDFLARENETUS United States 22->74 56 C:\ProgramData\Dllhost\winlogson.exe, PE32+ 22->56 dropped 58 C:\ProgramData\Dllhost\dllhost.exe, PE32 22->58 dropped 60 C:\ProgramData\Dllhost\WinRing0x64.sys, PE32+ 22->60 dropped 96 Sample is not signed and drops a device driver 22->96 33 cmd.exe 1 22->33         started        36 cmd.exe 22->36         started        38 cmd.exe 22->38         started        62 C:\Users\user\AppData\Local\Temp\...\alex.exe, PE32 27->62 dropped file14 signatures15 process16 signatures17 84 Encrypted powershell cmdline option found 33->84 86 Uses schtasks.exe or at.exe to add and modify task schedules 33->86 40 powershell.exe 5 33->40         started        42 conhost.exe 33->42         started        44 conhost.exe 36->44         started        46 schtasks.exe 36->46         started        48 conhost.exe 38->48         started        50 schtasks.exe 38->50         started        process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4aa853c8b52d8846ca5593c6af59c6bcb925027b7227283cedebf97303ad7241/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 19:24:14 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkufhsfvfweenssvspdk6wogxs4skat3oitsqphn5p4xga5nojaq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220829-x4cntsfae8/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine payload
Unpacked files
SH256 hash:
00b5221f98235f8997d8709fe6bb3dc12e0fb892bc58f20210828e2c3d5b59df
MD5 hash:
ac75000cbc91cccd3f5714537ed688f7
SHA1 hash:
c9c214b042ee5e685b47e46ea3a59b5795633460
Link:
https://www.unpac.me/results/70bdcec5-5c49-42b6-8dfe-1b2e0e09f1c0/
SH256 hash:
95c293f876030c70a38dcc13a9ce105574f116416a154320cbd089f343b5528d
MD5 hash:
484da9f6862e047f987d2b7f51e301cc
SHA1 hash:
5babdb859fbd01d47d6379926d9f1fe924ec8e37
Link:
https://www.unpac.me/results/70bdcec5-5c49-42b6-8dfe-1b2e0e09f1c0/
SH256 hash:
4aa853c8b52d8846ca5593c6af59c6bcb925027b7227283cedebf97303ad7241
MD5 hash:
7835486c4edc317ceeec1d761e66249f
SHA1 hash:
42d2cfa6b5a4a3e3f2785a2d18d43c8c0f7c9f3e
Link:
https://www.unpac.me/results/70bdcec5-5c49-42b6-8dfe-1b2e0e09f1c0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4aa853c8b52d8846ca5593c6af59c6bcb925027b7227283cedebf97303ad7241

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2282159/
Cape
Cape
https://www.capesandbox.com/analysis/302318/

Comments