MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 2 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87
SHA3-384 hash: 49bf8a0af725d28f6be38d0c3c980b5b7f6f85d4d874d5deceae25cb8e8de92765a87cb70879a099d312311f9572b0d9
SHA1 hash: 9b723a84d878b65b84cf5a9d7161b0d7e30e293a
MD5 hash: b6ae36b315145f7f00baefca855b7530
humanhash: sodium-oxygen-pasta-six
File name:b6ae36b315145f7f00baefca855b7530.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:474'112 bytes
First seen:2022-09-29 15:47:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'652 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 12288:xaiG9+8QKZh+EYEaF6UMK5j362G508AzjPWrvB:5W+8QKZ8EYnF6UMKpO08AXPWD
Threatray 506 similar samples on MalwareBazaar
TLSH T1D9A423D93A6873DFD94B877DCDAA1E95B1B464636315E7CB800B21253D4CEC34B0A8A3
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
116.203.238.163:20264 https://threatfox.abuse.ch/ioc/858542/
167.235.251.104:48637 https://threatfox.abuse.ch/ioc/858543/

Intelligence

File Origin
# of uploads :
1
# of downloads :
300
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/314876/
Detection(s):
PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Creating a file
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
DNS request
Launching the default Windows debugger (dwwin.exe)
Launching a process
Stealing user critical data
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6335be325c60ccc9fcfe853c/reports/22500fe3-46ae-4c94-8575-2744278b710f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/de311c25-7b08-428e-851d-1032df1e0100
Result
Threat name:
Nymaim, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1080248
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses nslookup.exe to query domains
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Nymaim
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 712806 Sample: zF7GXAEpje.exe Startdate: 29/09/2022 Architecture: WINDOWS Score: 100 94 85.31.46.167 CLOUDCOMPUTINGDE Germany 2->94 96 www.pcbooster.com 2->96 98 8 other IPs or domains 2->98 116 Snort IDS alert for network traffic 2->116 118 Malicious sample detected (through community Yara rule) 2->118 120 Antivirus detection for URL or domain 2->120 122 9 other signatures 2->122 11 zF7GXAEpje.exe 3 2->11         started        15 rundll32.exe 2->15         started        signatures3 process4 file5 82 C:\Users\user\AppData\...\zF7GXAEpje.exe.log, ASCII 11->82 dropped 140 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->140 142 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->142 17 zF7GXAEpje.exe 15 21 11->17         started        22 zF7GXAEpje.exe 11->22         started        24 zF7GXAEpje.exe 11->24         started        26 zF7GXAEpje.exe 11->26         started        signatures6 process7 dnsIp8 88 116.203.238.163, 20264, 49698 HETZNER-ASDE Germany 17->88 90 95.214.24.96, 49700, 80 CMCSUS Germany 17->90 92 8 other IPs or domains 17->92 76 C:\Users\user\AppData\Local\Temp\sr23vs.exe, PE32 17->76 dropped 78 C:\Users\user\AppData\Local\...\sr235vs.exe, PE32 17->78 dropped 80 C:\Users\user\AppData\Local\Temp\s3r3vs.exe, PE32 17->80 dropped 124 Tries to harvest and steal browser information (history, passwords, etc) 17->124 126 Tries to steal Crypto Currency Wallets 17->126 28 s3r3vs.exe 1 5 17->28         started        31 sr235vs.exe 17->31         started        34 sr23vs.exe 15 17->34         started        37 2 other processes 17->37 file9 signatures10 process11 dnsIp12 144 Machine Learning detection for dropped file 28->144 146 Uses nslookup.exe to query domains 28->146 39 cmd.exe 28->39         started        42 nslookup.exe 1 28->42         started        84 C:\Users\user\...\PCBoosterSetup (3).exe, PE32 31->84 dropped 86 C:\Users\user\...\HolocrineSpluttered.exe, PE32 31->86 dropped 148 Multi AV Scanner detection for dropped file 31->148 100 208.67.104.97, 49760, 80 GRAYSON-COLLIN-COMMUNICATIONSUS United States 34->100 45 cmd.exe 34->45         started        47 WerFault.exe 34->47         started        49 WerFault.exe 34->49         started        55 5 other processes 34->55 102 192.168.2.4 unknown unknown 37->102 104 239.255.255.250 unknown Reserved 37->104 150 Obfuscated command line found 37->150 51 chrome.exe 37->51         started        53 chrome.exe 37->53         started        file13 signatures14 process15 dnsIp16 128 Submitted sample is a known malware sample 39->128 130 Obfuscated command line found 39->130 132 Uses ping.exe to sleep 39->132 134 Uses ping.exe to check the status of other devices and networks 39->134 57 cmd.exe 39->57         started        60 conhost.exe 39->60         started        62 PING.EXE 39->62         started        106 8.8.8.8.in-addr.arpa 42->106 108 3874982763784yhwgdfg78234789s42809374918uhf 42->108 64 conhost.exe 42->64         started        66 conhost.exe 45->66         started        110 iplogger.org 148.251.234.83, 443, 49705, 49708 HETZNER-ASDE Germany 51->110 112 www.google.com 142.250.203.100, 443, 49710, 49716 GOOGLEUS United States 51->112 114 4 other IPs or domains 51->114 signatures17 process18 signatures19 136 Obfuscated command line found 57->136 138 Uses ping.exe to sleep 57->138 68 tasklist.exe 57->68         started        70 find.exe 57->70         started        72 tasklist.exe 57->72         started        74 3 other processes 57->74 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87/
Threat name:
ByteCode-MSIL.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-24 16:48:32 UTC
File Type:
PE (.Net Exe)
AV detection:
31 of 39 (79.49%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdbvi3kzvzy6dlu52b3fq5ga2nuo6l6liq7o4wvgrs4da4yurkdq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
2eb568e926e35c6508b8f9f4ca8ad5b9ffa85c247d14b69031f3722c60ea06db
RedLineStealer
39483efa8bad7c409446253722bc9ecc943554873a5952e5eff77ed8a9adfad7
RedLineStealer
6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47
RedLineStealer
8ecbe3f78c01ca3ddb3cd79498d97441c9f08cc3c2d2416546aee250ff84877e
RedLineStealer
9e6548b653ee412b729f669bad36d14d12a385176c0b83e945d9c446c90916e3
RedLineStealer
bb5938ca20203ecde3fc65a31025801a1c136b90c76d7816edcb58db733ca3ed
RedLineStealer
d74e35ce1229ef0e134937caa01fd67a8fdf3fd0c7a85762090b10631fb526b7
RedLineStealer
+ 496 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:nymaim family:redline family:vidar botnet:1531 botnet:petyshara discovery infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/220929-s8rakacccl/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates processes with tasklist
Kills process with taskkill
Modifies Internet Explorer settings
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
NyMaim
RedLine
RedLine payload
Vidar
Malware Config
C2 Extraction:
116.203.238.163:20264
https://t.me/huobiinside
https://mas.to/@kyriazhs1975
208.67.104.97
85.31.46.167
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/04fd4101-ab60-45f3-9f24-892b616cbaed
Unpacked files
SH256 hash:
696fa0502f0a9dd6c4273978df9156f7e178c06d70b7544d96df41d9cebb7ca4
MD5 hash:
bd6b6d85c647bcb7f12e92671ac2c9f7
SHA1 hash:
4521e548bbf17ed96747e101c65df27fdf13baad
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/59830dd8-37f7-4c01-8f65-6347c87c0cbe/
Parent samples :
50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87
835bb6b82aacaa1dade1954799f7161e66414a9d8f8de8854a44ff4b66c4d445
SH256 hash:
a1ff2b09422a07b4d2532b664f329b717078b152cbe26836cf747f059ec59d79
MD5 hash:
ad8cdac074cd15f9403c73cfb557af49
SHA1 hash:
236135e394a60b03c3277b325fc7c83f4b536db5
Link:
https://www.unpac.me/results/59830dd8-37f7-4c01-8f65-6347c87c0cbe/
SH256 hash:
50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87
MD5 hash:
b6ae36b315145f7f00baefca855b7530
SHA1 hash:
9b723a84d878b65b84cf5a9d7161b0d7e30e293a
Link:
https://www.unpac.me/results/59830dd8-37f7-4c01-8f65-6347c87c0cbe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.71
Link:
https://yomi.yoroi.company/submissions/50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 50c3546d59ae71e1ae9dd0765874c0d368ef2fcb443eee5aa68cb83073148a87

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2323183/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/314876/

Comments