MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38
SHA3-384 hash: 711a5f792437f6d0bbea813d49bb23191ad83fbf3e9e44ba97ea32db290234a83ae861390ab12297dd952545fc5eff5c
SHA1 hash: 611ddf0b6cb01edd77969925d242c7d0685e9750
MD5 hash: 5b2efc41e60b436ff9bce0ae4f8fd30a
humanhash: timing-undress-cup-blue
File name:5b2efc41e60b436ff9bce0ae4f8fd30a
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:102'400 bytes
First seen:2021-08-17 09:31:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:RTo6aGLKC7i2RHZVeb5N9HSBoh5TAauswsgbue7vduvNyAsdBdetx5RE7G6WAaof:ddxGCD3MbZHtZDi3dulyddONWh9
Threatray 1'232 similar samples on MalwareBazaar
TLSH T14CA32A3263ACC629F7BE0A366870021587F1E0CB6412E75E5EC174EA1E767826548FF7
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5b2efc41e60b436ff9bce0ae4f8fd30a
Verdict:
Malicious activity
Analysis date:
2021-08-17 09:34:38 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/86ddb85a-2c5d-4156-a795-484b05ec1756

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179917/
Detection(s):
Win.Packed.Bulz-9883367-0
Create hunting rule

Win.Packed.Generickdz-9885340-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP POST request
Sending a custom TCP request
Creating a file in the %temp% directory
Reading critical registry keys
Deleting a recently created file
Using the Windows Management Instrumentation requests
Creating a window
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Changing a file
Sending a UDP request
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4d283b0-c5a7-4166-a90a-3e413cfaa7ad
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/834232
Signature
Detected unpacking (changes PE section rights)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 466663 Sample: YfbB61z87a Startdate: 17/08/2021 Architecture: WINDOWS Score: 100 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected RedLine Stealer 2->43 7 YfbB61z87a.exe 15 32 2->7         started        process3 dnsIp4 35 download.anydesk.com 188.40.104.135, 443, 49761 HETZNER-ASDE Germany 7->35 37 softwarebeast.live 45.153.241.106, 49735, 49755, 49759 COMBAHTONcombahtonGmbHDE Germany 7->37 39 api.ip.sb 7->39 25 C:\Users\user\AppData\Local\...\AnyDesk.exe, PE32 7->25 dropped 27 C:\Users\user\AppData\...\YfbB61z87a.exe.log, ASCII 7->27 dropped 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->45 47 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 7->47 49 Tries to harvest and steal browser information (history, passwords, etc) 7->49 51 Tries to steal Crypto Currency Wallets 7->51 12 AnyDesk.exe 14 7->12         started        15 conhost.exe 7->15         started        file5 signatures6 process7 signatures8 53 Detected unpacking (changes PE section rights) 12->53 55 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 12->55 57 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->57 59 4 other signatures 12->59 17 AnyDesk.exe 1 2 12->17         started        21 AnyDesk.exe 6 12->21         started        process9 dnsIp10 29 78.138.106.18, 49772, 80 VELIANET-ASvelianetInternetdiensteGmbHDE Germany 17->29 31 boot-01.net.anydesk.com 78.138.106.22, 443 VELIANET-ASvelianetInternetdiensteGmbHDE Germany 17->31 33 relay-a06d1f0b.net.anydesk.com 51.91.80.121, 443, 49773 OVHFR France 17->33 23 C:\Users\user\AppData\Local\Temp\gcapi.dll, PE32 17->23 dropped file11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38/
Threat name:
ByteCode-MSIL.Infostealer.RedLine
Create hunting rule
Status:
Malicious
First seen:
2021-08-15 14:24:56 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kf43se7ftitdxlsjzm652x7hsju2e6lfg77gov3hezg5gd72bi4a._file
Verdict:
malicious
Similar samples:
0f1962c4d1f9a9fe7b7d5d22f79ab02c7aa9f990a305860082134d47e3cd2a09
RedLineStealer
32cf0e4532d6617a76a22f45edfe5d10ecbaf10040cedffdb2cea5126b6ff053
RedLineStealer
4ac6e78bf14a825b213dffb029102a9c57bfd7d6f203bbd3259286ce49ed8add
RedLineStealer
80752bd3e74c165e9c88fee2b806b67641f6cdae222d4ef9f5bc433f8501e767
RedLineStealer
9af2474823d8274925ccbc39726f4766c675c3e996dedfbbb6a4b07d86af6fe7
RedLineStealer
9dc934f7f22e493a1c1d97107edc85ccce4e1be155b2cc038be8d9a57b2e430f
RedLineStealer
a8c01f337163dc0e0bccb3a85bd0bdca149a199e2d879771e05037ed00c8e967
RedLineStealer
aa504b0c2fe4bdcdca89d5c367887fa653665b2228add241ce0c86f950b56ad8
RedLineStealer
b25de8622f43e2beb203e0e394906bd6832f95277f53c4dbd59d4afbcef7b361
RedLineStealer
d269615dd97e39c3625988646ad11311cde5a6e4074a43181bd68229646ac0f1
RedLineStealer
+ 1'222 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:mongol discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210817-7nceysxgs2/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
Malware Config
C2 Extraction:
softwarebeast.live:80
Unpacked files
SH256 hash:
5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38
MD5 hash:
5b2efc41e60b436ff9bce0ae4f8fd30a
SHA1 hash:
611ddf0b6cb01edd77969925d242c7d0685e9750
Link:
https://www.unpac.me/results/a8d8b639-98f0-428f-bcbc-69e4f740adbd/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5179b913e59a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.74
Link:
https://yomi.yoroi.company/submissions/5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 5179b913e59a263bae49cb3ddd5fe79269a2796537fe675767264dd30ffa0a38

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1541322/
Cape
Cape
https://www.capesandbox.com/analysis/179917/

Comments