MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f1dd4357574c51ec7871212dbc7439c1013561041b5d6b3d5e5ce0dac996aeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f1dd4357574c51ec7871212dbc7439c1013561041b5d6b3d5e5ce0dac996aeb
SHA3-384 hash: 3c89040f9dd9eb6d6b9cae7475e0b3b5c5a0f978b23eb77e7dfc7c9b1d9c2484fc5b03cc3683d934a7e7d7b06700fd8b
SHA1 hash: bbd58248744300663a731b187009ccd9f3dba061
MD5 hash: 8a3d223099187ac0705be841302aaddf
humanhash: jersey-march-steak-five
File name:02.bat
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:7'486'925 bytes
First seen:2024-03-26 07:01:52 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 98304:i999999999999999999999999999999999999999999999999999999999999996:n
TLSH T1BB76C04C29CC1C61F2CB97A97C52AE1C7153BBCB89A7351F8249EF51B4A87AC217470E
Reporter petrovic
Tags:bat Redline RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
02.bat
Verdict:
Malicious activity
Analysis date:
2024-03-26 06:03:49 UTC
Tags:
stealer redline
Link:
https://app.any.run/tasks/b55517c7-3cac-4bb9-a311-87932e29aae7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching cmd.exe command interpreter
Searching for the window
Launching a process
Creating a window
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Adding a root certificate
Changing a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Forced shutdown of a browser
Verdict:
Malicious
Labled as:
PowerShell/Kryptik.HJ trojan
Link:
https://www.hybrid-analysis.com/sample/4f1dd4357574c51ec7871212dbc7439c1013561041b5d6b3d5e5ce0dac996aeb
Result
Verdict:
MALICIOUS
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1415604
Signature
Connects to many ports of the same IP (likely port scanning)
Found large BAT file
Installs new ROOT certificates
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Very long command line found
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1415604 Sample: 02.bat Startdate: 26/03/2024 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected RedLine Stealer 2->40 42 2 other signatures 2->42 8 cmd.exe 1 2->8         started        process3 signatures4 44 Very long command line found 8->44 11 cmd.exe 1 8->11         started        14 conhost.exe 8->14         started        process5 signatures6 46 Very long command line found 11->46 16 powershell.exe 6 37 11->16         started        20 conhost.exe 11->20         started        22 cmd.exe 1 11->22         started        process7 dnsIp8 26 15.235.131.20, 39206, 49729 HP-INTERNET-ASUS United States 16->26 28 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->28 30 Suspicious powershell command line found 16->30 32 Installs new ROOT certificates 16->32 34 3 other signatures 16->34 24 powershell.exe 8 16->24         started        signatures9 process10
Score:
48%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/4f1dd4357574c51ec7871212dbc7439c1013561041b5d6b3d5e5ce0dac996aeb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f1dd4357574c51ec7871212dbc7439c1013561041b5d6b3d5e5ce0dac996aeb/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2024-03-25 14:41:22 UTC
File Type:
Text
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4o5inlvotcr5r4hcijnxr2dtqibgvqqig25nm6v4xha3leznlvq._file
Verdict:
unknown
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware
Link:
https://tria.ge/reports/240326-htsjzadg26/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Blocklisted process makes network request
RedLine
RedLine payload
Malware Config
C2 Extraction:
15.235.131.20:39206
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f1dd4357574c51ec7871212dbc7439c1013561041b5d6b3d5e5ce0dac996aeb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments