MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51921d13908bd84b1c8fbdd77e6e29d4359ce0fc40857f6f0ad15b1b6ee74730. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 4 File information Comments

SHA256 hash:	51921d13908bd84b1c8fbdd77e6e29d4359ce0fc40857f6f0ad15b1b6ee74730
SHA3-384 hash:	fd96175042680239f1f3c23a1d8b115a4237d21ad0d9eff4956db83eb9fdbfbf580b0feef030bdc4de6915a67d6b51bd
SHA1 hash:	a9282e204443fed6e0be28e8e2dfe7c927706428
MD5 hash:	74b6b35627f6453d787f1c7ea3b9ec33
humanhash:	finch-berlin-hydrogen-ink
File name:	ChromeFIX_errorMEM.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	253'952 bytes
First seen:	2023-03-18 23:25:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	df35d969e1568731b4c070bee6bd7122 (2 x CoinMiner, 2 x RedLineStealer, 1 x DCRat)
ssdeep	3072:W1jGFFPBsryKxPUBnIZ/C9FUYHwKLLgQmsbVVTjC3r7wcLl2byii5DzrIlu:ug3iPUZIAFUYHDPaQVXC3xR2/iNo
Threatray	2'156 similar samples on MalwareBazaar
TLSH	T19B441813311F3E60E1FA69B8889DF3865516E3710A6DDB5D73AB0E2E4D09DC39920B36
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	tcains1
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

363

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

Setu_WINFile_x64x32.rar

Verdict:

Malicious activity

Analysis date:

2023-03-18 23:11:10 UTC

Tags:

trojan amadey loader rat redline

Link:

https://app.any.run/tasks/436804e2-6678-4bf4-b69a-fb8cf83f73bf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/375432/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.235137.15924.16775.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Stealing user critical data

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/73862/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

babar greyware packed ransomware

Link:

https://www.filescan.io/uploads/6416488bc60b3295f52bcab7/reports/eae40040-2289-4488-908e-0008cffb64e9/overview

Verdict:

Malicious

Labled as:

Mal_HPGen

Link:

https://www.hybrid-analysis.com/sample/51921d13908bd84b1c8fbdd77e6e29d4359ce0fc40857f6f0ad15b1b6ee74730

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1dbf184e-17e4-4a51-8c93-a99b55201c76

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1196798

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/51921d13908bd84b1c8fbdd77e6e29d4359ce0fc40857f6f0ad15b1b6ee74730/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2023-03-18 23:26:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kgjb2e4qrpmewhepxxlx43rj2q2zzyh4iccx63yk2fnrw3xhi4ya._file

Verdict:

malicious

RedLineStealer

097bd6ce6d754f614b0cb7c0be5f4adeea5fd65bfb736208619c1b3d4cbbfb7a

RedLineStealer

34db61f23c2701386292bb8c50ee4a0a425051a255335b07c17a880aa185666a

RedLineStealer

5331428611e6a398284611837de8d995d012abbc444f69acfdfb370ef6655f88

RedLineStealer

711e3aaa29ad4bb5581bff65bf3e8d67c4afe4a855dbbe19526cbb1e7f6e0992

RedLineStealer

7cda2feba97580aa0805afddc418c53eb7bc7ce80eab09c53a7f83289176c376

RedLineStealer

8ae79bd64f0f7222b4b2130855e80228efa732505718bf2f436927c6315ce8f4

RedLineStealer

cc9faa4d1d9909f267a14006282af5bf3a16bc25fd056c34a8481bfdf1586907

RedLineStealer

dfe8b10d567d99e44deed014c4f686a1d28fecf9d763ecaefd24916551a75707

RedLineStealer

e974acd3fc49aec16b85d46b91375e04f2f69a5332fe3fbc0182fbcb1c61a425

RedLineStealer

+ 2'146 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer spyware

Link:

https://tria.ge/reports/230318-3ettpsea88/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

RedLine

Malware Config

C2 Extraction:

135.181.173.163:4323

Unpacked files

SH256 hash:

594eea4bb48fe22a75299006277a5a47f12d9053afe4f1214b13346f763e7225

MD5 hash:

7e6dad9f67b0d7b47a4d327669c1fb67

SHA1 hash:

cdd0247c973d9b5b2f445c92b7d38b8829d8a80a

Detections:

redline

Link:

https://www.unpac.me/results/d5ef7829-ad5d-4915-b31c-095d8bb3cf60/

SH256 hash:

51921d13908bd84b1c8fbdd77e6e29d4359ce0fc40857f6f0ad15b1b6ee74730

MD5 hash:

74b6b35627f6453d787f1c7ea3b9ec33

SHA1 hash:

a9282e204443fed6e0be28e8e2dfe7c927706428

Link:

https://www.unpac.me/results/d5ef7829-ad5d-4915-b31c-095d8bb3cf60/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/51921d13908b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/51921d13908bd84b1c8fbdd77e6e29d4359ce0fc40857f6f0ad15b1b6ee74730

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Win32_Trojan_RedLineStealer Create hunting rule
Author:	Netskope Threat Labs
Description:	Identifies RedLine Stealer samples
Reference:	deb95cae4ba26dfba536402318154405