MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d9499d542632ab7a709685646fc0604e1bd6f3899490e37f7f985e2a245c7fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d9499d542632ab7a709685646fc0604e1bd6f3899490e37f7f985e2a245c7fc
SHA3-384 hash: 3e206503ccadcf3c57d41ecfa115208679c5ec2bc4511a081d44b21a047b397b55cf04f3291bb18abbd4915d4b0956c9
SHA1 hash: 4b9769c850d708f9d098a9f56096031c5f1e69c2
MD5 hash: 37ab4605cc0b1a486bebad71f9b9d9f7
humanhash: cold-cola-twelve-quebec
File name:37ab4605cc0b1a486bebad71f9b9d9f7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'222'328 bytes
First seen:2021-06-29 19:31:24 UTC
Last seen:2021-06-29 20:43:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:eQuGx7oKerqAnw7p1lZXM20Ewer1pXVGqS36rCPUh/C/S:zrSuAnwLlZXM20ERzkqS3kCPUha/S
Threatray 6'592 similar samples on MalwareBazaar
TLSH 9945FC037C4CE351EAE05E3741EE6D3C23E559CA8633560BAF06FDA924B26459CB236D
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
130.193.54.53:32750

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
130.193.54.53:32750 https://threatfox.abuse.ch/ioc/155836/

Intelligence

File Origin
# of uploads :
2
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
37ab4605cc0b1a486bebad71f9b9d9f7.exe
Verdict:
Malicious activity
Analysis date:
2021-06-29 19:44:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7607e7bc-e634-4a1c-a8ea-4453c843fbe3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168821/
Detection(s):
SecuriteInfo.com.UDS.Trojan-PSW.MSIL.Reline.gen.5768.17864.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c9c09a84-0973-4678-bb7c-e9cb2585775e
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/809637
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 442051 Sample: I2VQzf34i3.exe Startdate: 29/06/2021 Architecture: WINDOWS Score: 100 35 s3-w.us-east-1.amazonaws.com 2->35 37 s3-1-w.amazonaws.com 2->37 39 3 other IPs or domains 2->39 47 Multi AV Scanner detection for domain / URL 2->47 49 Found malware configuration 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 8 other signatures 2->53 9 I2VQzf34i3.exe 3 2->9         started        signatures3 process4 file5 31 C:\Users\user\AppData\...\I2VQzf34i3.exe.log, ASCII 9->31 dropped 55 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->55 57 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->57 13 I2VQzf34i3.exe 15 32 9->13         started        signatures6 process7 dnsIp8 41 130.193.54.53, 32750, 49753, 49756 YANDEXCLOUDRU Russian Federation 13->41 43 xey.kowashitekata.ru 217.107.34.191, 443, 49758 RTCOMM-ASRU Russian Federation 13->43 45 api.ip.sb 13->45 33 C:\Users\user\AppData\Local\Temp\tempfl.exe, PE32 13->33 dropped 59 Tries to harvest and steal browser information (history, passwords, etc) 13->59 61 Tries to steal Crypto Currency Wallets 13->61 18 tempfl.exe 14 184 13->18         started        file9 signatures10 process11 file12 23 C:\Users\user\AppData\...\ssleay32.dll, PE32 18->23 dropped 25 C:\Users\user\AppData\...\qclp-2.3.dll, PE32 18->25 dropped 27 C:\Users\user\AppData\...\pthreadGC2.dll, PE32 18->27 dropped 29 22 other files (none is malicious) 18->29 dropped 21 audiolic.exe 1 18->21         started        process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d9499d542632ab7a709685646fc0604e1bd6f3899490e37f7f985e2a245c7fc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-29 19:23:58 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwkjtvkcmmvlpjyjnblen7agatq323zytfeq4n7x7gc6fisfy76a._file
Verdict:
malicious
Similar samples:
04b5b5acf81fdeb886fd6387abd8f5b1c31586c2907c635c703e7b1320dda579
RedLineStealer
1d64d3eb1c28bda9e53ed296e9a84092b655deb5fb27aac6ee6d99c65ee6f118
RedLineStealer
397e2b5da2c8a13a8eafd1d05a6a320fdb9c18d90811787ec4383531e683f2ba
RedLineStealer
510d3eadc5652908d47db79067009b04cf4e9234720f052e90cc7d18ffad0b20
RedLineStealer
619f3111ecda81c05a1caa5d84be3bd13afd54439610738637615da53418922a
RedLineStealer
987540db2502a6f2264ecd208ff0bd4cc30fd4dd96ce8829d6d537660b7f2826
RedLineStealer
98b74ea068218a325878848a9631ccabf943ca0ac0a0ff435b6ed276d806c72b
RedLineStealer
bae19f194f0d4d760e6dd07ce9e806d052d7dfcaa11c7dd15523b6967e2c9d22
RedLineStealer
d3232518770bbe5b2d05e94aae1a70d1f89114c88557ba6a1cf24541eb4aae2a
RedLineStealer
d776341c2665e96054eb584de15e34b8371398e2055f20ccaa4710f441fcf587
RedLineStealer
+ 6'582 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:prolib9 discovery evasion infostealer spyware stealer themida trojan
Link:
https://tria.ge/reports/210629-t1t5bxg5hs/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
RedLine Payload
Malware Config
C2 Extraction:
130.193.54.53:32750
Unpacked files
SH256 hash:
52d7c198c2a4698833bc4ac415d0d2e45beea7646d3e448ebeee314d86f6dc4e
MD5 hash:
b086a1e0cb00f8231235833c3883c333
SHA1 hash:
e33af3008a336e3a746b3a0e0296c3ffc3ee2fac
Link:
https://www.unpac.me/results/eef7f391-1fa8-4cb4-a4a5-8fcbba6a85ab/
SH256 hash:
04641b61bd59bf46b1c7c86840d6d3875b4a726a575b73cedb3611307b7f7cf3
MD5 hash:
fa9158c63d8c4a998c38ec34ddfb985e
SHA1 hash:
7a2063469d2dfaf5f958d7afa3a24238ce043951
Link:
https://www.unpac.me/results/eef7f391-1fa8-4cb4-a4a5-8fcbba6a85ab/
SH256 hash:
4d9499d542632ab7a709685646fc0604e1bd6f3899490e37f7f985e2a245c7fc
MD5 hash:
37ab4605cc0b1a486bebad71f9b9d9f7
SHA1 hash:
4b9769c850d708f9d098a9f56096031c5f1e69c2
Link:
https://www.unpac.me/results/eef7f391-1fa8-4cb4-a4a5-8fcbba6a85ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4d9499d542632ab7a709685646fc0604e1bd6f3899490e37f7f985e2a245c7fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 4d9499d542632ab7a709685646fc0604e1bd6f3899490e37f7f985e2a245c7fc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1364158/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/168821/

Comments