MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 504269867e09b5e478d15f55b16dcc7e79f91c048cdc536d0f459bc728d385e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 504269867e09b5e478d15f55b16dcc7e79f91c048cdc536d0f459bc728d385e5
SHA3-384 hash: cb56b6af5eda5bcd56121f75414c5c5e24ce518bb9efc7bd5c5c4c3a24daf1fbc747992556c16686f212df70434cf5a6
SHA1 hash: 8d8092eeec2675da895067009d642dc8043e6123
MD5 hash: 7f38c90a3aee27bb58f381f75e59f730
humanhash: tennessee-sodium-winner-mississippi
File name:M5_Game_v3.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'434'944 bytes
First seen:2022-02-11 16:54:02 UTC
Last seen:2022-02-11 19:10:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7dc28ef949f54ad98c715895ecc34cff (79 x RedLineStealer, 2 x Formbook)
ssdeep 98304:2HHF7BZexMAxUmJ4hhaQjeWquWcV+fkVkPqnRn+5Yt:2HZBZO0mJ4MWqdcCLqRni4
Threatray 1'247 similar samples on MalwareBazaar
TLSH T17626330D1380FC90E9450E3954EEF9F21839AF6E55B21C47FB8B4BE2376A253F552A12
Reporter adm1n_usa32
Tags:exe Redline RedLineStealer


Avatar
adm1n_usa32
distributed via discord hacked account

Intelligence

File Origin
# of uploads :
2
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
M5_Game_v3.exe
Verdict:
Malicious activity
Analysis date:
2022-02-11 16:50:42 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/5b8c3437-8fd9-4fb4-a2b0-570fb45a045c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/240944/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
DNS request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed yakes
Link:
https://www.filescan.io/uploads/620694ed45ddfa2e18c02aa5/reports/8f6bbca9-8d36-429f-8b2e-9aff01102fbc/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70c8f1b7-01d6-4ae1-a966-02f881432ae3
Result
Threat name:
RedLine TON Miner
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/938462
Signature
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected TON Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 570940 Sample: M5_Game_v3.exe Startdate: 11/02/2022 Architecture: WINDOWS Score: 100 85 Found malware configuration 2->85 87 Malicious sample detected (through community Yara rule) 2->87 89 Multi AV Scanner detection for submitted file 2->89 91 5 other signatures 2->91 10 M5_Game_v3.exe 1 2->10         started        13 RegHost.exe 2->13         started        process3 signatures4 97 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->97 99 Writes to foreign memory regions 10->99 101 Allocates memory in foreign processes 10->101 109 2 other signatures 10->109 15 AppLaunch.exe 15 7 10->15         started        20 conhost.exe 10->20         started        103 Multi AV Scanner detection for dropped file 13->103 105 Machine Learning detection for dropped file 13->105 107 Modifies the context of a thread in another process (thread injection) 13->107 22 conhost.exe 13->22         started        24 bfsvc.exe 13->24         started        process5 dnsIp6 73 193.106.191.100, 49759, 5112 BOSPOR-ASRU Russian Federation 15->73 75 transfer.sh 144.76.136.153, 443, 49815 HETZNER-ASDE Germany 15->75 65 C:\Users\user\AppData\Local\...\filename.exe, PE32+ 15->65 dropped 77 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->77 79 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->79 81 Tries to harvest and steal browser information (history, passwords, etc) 15->81 83 Tries to steal Crypto Currency Wallets 15->83 26 filename.exe 1 2 15->26         started        file7 signatures8 process9 file10 67 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 26->67 dropped 111 Multi AV Scanner detection for dropped file 26->111 113 Machine Learning detection for dropped file 26->113 115 Injects code into the Windows Explorer (explorer.exe) 26->115 117 4 other signatures 26->117 30 explorer.exe 2 26->30         started        32 curl.exe 1 26->32         started        35 bfsvc.exe 1 26->35         started        37 conhost.exe 26->37         started        signatures11 process12 dnsIp13 39 RegHost.exe 30->39         started        42 curl.exe 1 30->42         started        45 curl.exe 1 30->45         started        51 9 other processes 30->51 69 api.telegram.org 149.154.167.220, 443, 49817 TELEGRAMRU United Kingdom 32->69 47 conhost.exe 32->47         started        49 conhost.exe 35->49         started        process14 dnsIp15 93 Modifies the context of a thread in another process (thread injection) 39->93 95 Injects a PE file into a foreign processes 39->95 71 185.137.234.33, 49818, 49819, 49820 SELECTELRU Russian Federation 42->71 53 conhost.exe 42->53         started        55 conhost.exe 45->55         started        57 conhost.exe 51->57         started        59 conhost.exe 51->59         started        61 conhost.exe 51->61         started        63 4 other processes 51->63 signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/504269867e09b5e478d15f55b16dcc7e79f91c048cdc536d0f459bc728d385e5/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-11 16:55:18 UTC
File Type:
PE (Exe)
AV detection:
18 of 28 (64.29%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kbbgtbt6bg26i6grl5k3c3ompz47shaertofg3ipiwn4okgtqxsq._file
Verdict:
malicious
Similar samples:
0728f943b4d7f7e947f391aa5e77dec66a8208041aac22e70cfc9ed4a4a5d027
RedLineStealer
177281ae34e8e42aeca619f1a5dd728bb7dc4647b64b1411b2b13103c6b06865
RedLineStealer
2c7e8a9b546f7c133469fabcfc200e5ab79da84ffa180fda9e088bc5476af860
RedLineStealer
374ec0de5ab31bc54adc80e494194f0070a78839701d19b73b27ca605f05c768
RedLineStealer
3dc72b0f754bdd940a27033839a6b08c7ac6a41259a92764638194afe3e969de
RedLineStealer
5aaecc91eecab8970deeef790df826ad10dd5fb4a40695b1143b9a84773c3223
RedLineStealer
6e60006ac8af12483aee2b0f6bcf0a963a0423b494b55f56ad51bfc9b3a3bd71
RedLineStealer
a085e4af6a5b200d9cfe44c811c7f40e7f275122c5ae62b204835bbd6d7b1e05
RedLineStealer
+ 1'237 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220211-vejpqseecm/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
a8a83f978601b1070f018e18ebdaa2b3acfdd3a8bf9e86f9902c1babd6a1dda0
MD5 hash:
1738976a396a1c053b344af2be4c9515
SHA1 hash:
5296257c638d9e30f68032f81b167c4e7e8db549
Link:
https://www.unpac.me/results/b769ce94-4c3b-4096-ab4d-139c96891a01/
SH256 hash:
0026c7167f2ab7a89e25fa8e558cdb257af00b00057dd23eaf3272d0f06b3555
MD5 hash:
a036f0eeff2cea849f84222d306aa118
SHA1 hash:
8fdd16bf95c0b7de25d25d525dc77bd55d324edb
Link:
https://www.unpac.me/results/b769ce94-4c3b-4096-ab4d-139c96891a01/
SH256 hash:
504269867e09b5e478d15f55b16dcc7e79f91c048cdc536d0f459bc728d385e5
MD5 hash:
7f38c90a3aee27bb58f381f75e59f730
SHA1 hash:
8d8092eeec2675da895067009d642dc8043e6123
Link:
https://www.unpac.me/results/b769ce94-4c3b-4096-ab4d-139c96891a01/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/504269867e09/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:downloader_macros
Create hunting rule
Author:ddvvmmzz
Description:downloader macros
Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:obfuscate_macros
Create hunting rule
Author:ddvvmmzz
Description:obfuscate macros
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 504269867e09b5e478d15f55b16dcc7e79f91c048cdc536d0f459bc728d385e5

(this sample)

anyrun
any.run
https://app.any.run/tasks/5b8c3437-8fd9-4fb4-a2b0-570fb45a045c
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/240944/

Comments