MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51bda9cff13b4515a21d412a59a51746594613eed7fe0cb21f1ee8037baabf66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51bda9cff13b4515a21d412a59a51746594613eed7fe0cb21f1ee8037baabf66
SHA3-384 hash: 92bb53af3a73f13364820d04541ce89979773936fc302a5b4054f62848e00f1e481a41b126088d2a0d20bcf4a5398fe8
SHA1 hash: 18c3ee0cae1557b0da8443a1a06e652c1a64f272
MD5 hash: 3bc0f41166cf7bb68ca9dba8a69ea593
humanhash: bacon-lima-lake-twelve
File name:3bc0f41166cf7bb68ca9dba8a69ea593.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'271'008 bytes
First seen:2021-12-02 16:05:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Gq2zU+/zCAWqk0ruHCxwv0CxXBls7jAFXcIHzqJSNC7w6WDyknVOirvyEROyQBt1:n2g0ldnCrltFMQC7uDyknVZK0oPuCv
Threatray 565 similar samples on MalwareBazaar
TLSH T17F457C657BE3BE1FC3E526339029C49056E197406722E335F5FB22931E4B3B08E9A2D5
Reporter abuse_ch
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:Alkalify
Issuer:Alkalify
Algorithm:sha1WithRSAEncryption
Valid from:2021-11-23T21:00:00Z
Valid to:2031-11-30T21:00:00Z
Serial number: 244a475b1f6905954d10d5b81a00471d
Thumbprint Algorithm:SHA256
Thumbprint: 7cead84a4328653758c36036d510e9472f2829d1017efb73ad2201d83d4cb1b1
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3bc0f41166cf7bb68ca9dba8a69ea593.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-02 16:25:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ff4d4e67-1f9c-4ece-a8eb-8ba7e0137593

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/210792/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
DNS request
Creating a file
Сreating synchronization primitives
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed
Link:
https://www.filescan.io/uploads/61a8eeeff9d950eb11b6c2be/reports/01749f69-4a39-4ca2-ae3a-6e34bed6ea22/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f9c3c272-fbc3-4aaa-89dc-5d29aee9484f
Result
Threat name:
Amadey RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/900274
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Suspicius Add Task From User AppData Temp
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected Amadeys stealer DLL
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532754 Sample: MioCdsgnw3.exe Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 90 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->90 92 Multi AV Scanner detection for domain / URL 2->92 94 Multi AV Scanner detection for submitted file 2->94 96 8 other signatures 2->96 9 MioCdsgnw3.exe 3 2->9         started        process3 file4 64 C:\Users\user\AppData\...\MioCdsgnw3.exe.log, ASCII 9->64 dropped 114 Injects a PE file into a foreign processes 9->114 13 MioCdsgnw3.exe 15 7 9->13         started        signatures5 process6 dnsIp7 84 qo.ckauni.ru 81.177.141.85, 443, 49777, 49778 RTCOMM-ASRU Russian Federation 13->84 86 vs1.ckauni.ru 13->86 88 2 other IPs or domains 13->88 66 C:\Users\user\AppData\Local\Temp\mix112.exe, PE32 13->66 dropped 68 C:\Users\user\...\a_2021-12-01_19-40.exe, PE32 13->68 dropped 70 C:\Users\user\...\RotavirusEpithems.exe, PE32 13->70 dropped 72 C:\...\ImaumWamblier_2021-11-30_22-21.exe, PE32 13->72 dropped 17 a_2021-12-01_19-40.exe 4 13->17         started        21 ImaumWamblier_2021-11-30_22-21.exe 5 13->21         started        24 RotavirusEpithems.exe 3 13->24         started        26 mix112.exe 3 13->26         started        file8 process9 dnsIp10 62 C:\Users\user\AppData\Local\...\tkools.exe, PE32 17->62 dropped 98 Detected unpacking (changes PE section rights) 17->98 100 Detected unpacking (overwrites its own PE header) 17->100 102 Machine Learning detection for dropped file 17->102 104 Contains functionality to inject code into remote processes 17->104 28 tkools.exe 17->28         started        32 cmd.exe 17->32         started        34 cmd.exe 17->34         started        42 2 other processes 17->42 74 185.215.113.15, 21508, 49790 WHOLESALECONNECTIONSNL Portugal 21->74 106 Multi AV Scanner detection for dropped file 21->106 108 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->108 110 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->110 112 Tries to steal Crypto Currency Wallets 21->112 36 RotavirusEpithems.exe 24->36         started        38 mix112.exe 26->38         started        40 mix112.exe 26->40         started        file11 signatures12 process13 dnsIp14 76 185.215.113.35, 49784, 49785, 49786 WHOLESALECONNECTIONSNL Portugal 28->76 78 192.168.2.1 unknown unknown 28->78 116 Detected unpacking (changes PE section rights) 28->116 118 Detected unpacking (overwrites its own PE header) 28->118 120 Machine Learning detection for dropped file 28->120 122 Uses schtasks.exe or at.exe to add and modify task schedules 28->122 44 conhost.exe 32->44         started        46 cmd.exe 32->46         started        48 cacls.exe 32->48         started        50 conhost.exe 34->50         started        52 cmd.exe 34->52         started        54 cacls.exe 34->54         started        80 95.217.213.248 HETZNER-ASDE Germany 36->80 124 Tries to harvest and steal browser information (history, passwords, etc) 36->124 126 Tries to steal Crypto Currency Wallets 36->126 82 104.238.221.208 RELIABLESITEUS United States 38->82 56 conhost.exe 42->56         started        58 cacls.exe 42->58         started        60 2 other processes 42->60 signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51bda9cff13b4515a21d412a59a51746594613eed7fe0cb21f1ee8037baabf66/
Threat name:
ByteCode-MSIL.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 09:35:45 UTC
File Type:
PE (.Net Exe)
AV detection:
15 of 27 (55.56%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
023e7c9e73b997a33476a2d958fb237395b098872854ce2e92af2b89cd87ca7d
RedLineStealer
7c1c287f9ce0d8d90c95851781ff2732780177f6c1affecc9eed376436981112
RedLineStealer
9820500aae4c3b3b5ab38a63f9776a75cfb2203a20798682207aee9e6526aba8
RedLineStealer
9c2b3a7c5abdcd9cfbafc27cddcdd4054cea214e15d3a1666cf407d2479a1f7e
RedLineStealer
b201c48281c435efba27e323eb5c301c54344598f28fd09981c18797a12ac458
RedLineStealer
fb452b1488f00eb47c35b783125cb4ef2ef9c97e82ccda1c651ceaa3ee12a60e
RedLineStealer
+ 555 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:redline botnet:1.12.2021 botnet:1.12mix222 botnet:test01.12 discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/211202-tj34haacfq/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Amadey
RedLine
RedLine Payload
suricata: ET MALWARE Amadey CnC Check-In
Malware Config
C2 Extraction:
104.238.221.208:21732
185.215.113.15:21508
95.217.213.248:42382
185.215.113.35/d2VxjasuwS/index.php
Unpacked files
SH256 hash:
46fa77dd53d0d90fbaa6ecca592f13743fb014ebab686cf6eb3563af72b56281
MD5 hash:
b3295ba362927fc2fd02dbb39c2a42ca
SHA1 hash:
36dc7cdd454fb45b5c50cdf98d4fe58f18f2acff
Link:
https://www.unpac.me/results/0aec130d-b03b-4ee3-8890-f18d5c0137f8/
SH256 hash:
51bda9cff13b4515a21d412a59a51746594613eed7fe0cb21f1ee8037baabf66
MD5 hash:
3bc0f41166cf7bb68ca9dba8a69ea593
SHA1 hash:
18c3ee0cae1557b0da8443a1a06e652c1a64f272
Link:
https://www.unpac.me/results/0aec130d-b03b-4ee3-8890-f18d5c0137f8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.32
Link:
https://yomi.yoroi.company/submissions/51bda9cff13b4515a21d412a59a51746594613eed7fe0cb21f1ee8037baabf66

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/210792/

Comments