MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56013a94edeaf931e04fc0103058f3d183f1fd9f46e4e133d6f4bb63a0826486. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56013a94edeaf931e04fc0103058f3d183f1fd9f46e4e133d6f4bb63a0826486
SHA3-384 hash: c60f42061ebbaf0f2fb6dbf8a91a76df894ab0dae22779d3c86cd6336aff08f22838a74836de496b1087f7442a552e1d
SHA1 hash: f8b3ec505db1899c2419123662079feb37aa393e
MD5 hash: f1ba6bfb8e31df66d5f1add01c6cc8c1
humanhash: early-double-hydrogen-edward
File name:zara
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'562'575 bytes
First seen:2022-07-17 18:21:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash da0a8429d07681e0f845d1d4f08ae833 (28 x RedLineStealer, 2 x ArkeiStealer, 1 x PhoenixStealer)
ssdeep 24576:LSARpOPJYyYBvz0i6AMOzdsQ/thJ1J5bWOKIIuo3yPgLqjvaCsl3RuQ55313Iv:LSApOGpnJDpWkIuo3yPgOjLsl32
TLSH T18FC51B139ACB0D75DDD23BB4A1CB633AA734ED30CA2A9B7FB608C53559532C46C1A742
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter KdssSupport
Tags:exe RedLineStealer


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
1
# of downloads :
377
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
setup.exe
Verdict:
Malicious activity
Analysis date:
2022-07-17 17:18:44 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/8dc11612-d653-4077-b448-180bfc88a10d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291403/
Detection(s):
Win.Trojan.Zeus-9956395-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/26529/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Certishell
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fb00d2ee-4747-4c89-b07c-816065b05d54
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1034991
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 667485 Sample: zara.exe Startdate: 17/07/2022 Architecture: WINDOWS Score: 100 35 ftl.deekshith.eu.org 2->35 37 fsblink8.herokuapp.com 2->37 45 Snort IDS alert for network traffic 2->45 47 Multi AV Scanner detection for domain / URL 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 6 other signatures 2->51 10 zara.exe 1 2->10         started        signatures3 process4 signatures5 61 Contains functionality to inject code into remote processes 10->61 63 Writes to foreign memory regions 10->63 65 Injects a PE file into a foreign processes 10->65 13 AppLaunch.exe 15 8 10->13         started        18 conhost.exe 10->18         started        process6 dnsIp7 39 185.215.113.83, 49735, 60722 WHOLESALECONNECTIONSNL Portugal 13->39 41 ftl.deekshith.eu.org 188.114.96.3, 443, 49741, 49743 CLOUDFLARENETUS European Union 13->41 43 fsblink8.herokuapp.com 3.216.88.24, 443, 49742, 49744 AMAZON-AESUS United States 13->43 31 C:\Users\user\AppData\Local\Temp\start.exe, PE32+ 13->31 dropped 33 C:\Users\user\AppData\Local\...\Starter.exe, PE32 13->33 dropped 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->67 69 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->69 71 Tries to harvest and steal browser information (history, passwords, etc) 13->71 20 start.exe 13->20         started        23 Starter.exe 2 13->23         started        file8 signatures9 process10 signatures11 53 Multi AV Scanner detection for dropped file 20->53 55 Tries to harvest and steal browser information (history, passwords, etc) 20->55 25 cmd.exe 20->25         started        57 Antivirus detection for dropped file 23->57 59 Machine Learning detection for dropped file 23->59 process12 process13 27 conhost.exe 25->27         started        29 choice.exe 25->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56013a94edeaf931e04fc0103058f3d183f1fd9f46e4e133d6f4bb63a0826486/
Threat name:
Win32.Trojan.Redlinestealer
Create hunting rule
Status:
Malicious
First seen:
2022-07-17 18:22:14 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyatvfhn5l4tdycpyaidawht2gb7d7m7i3socm6w6s5whiecmsda._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware
Link:
https://tria.ge/reports/220717-wzw18sedg2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine payload
Malware Config
C2 Extraction:
185.215.113.83:60722
Unpacked files
SH256 hash:
0508c6c466dcc8e444fe53574eae0d3958e2eef79b76522b8247ad49e052dbef
MD5 hash:
5464af239f0110b8364556544133b120
SHA1 hash:
48d0bdc88c45c919056a9633a53d40633ed03681
Link:
https://www.unpac.me/results/dc39e0a4-f9a5-4d43-b286-35a10f355aa0/
SH256 hash:
56013a94edeaf931e04fc0103058f3d183f1fd9f46e4e133d6f4bb63a0826486
MD5 hash:
f1ba6bfb8e31df66d5f1add01c6cc8c1
SHA1 hash:
f8b3ec505db1899c2419123662079feb37aa393e
Link:
https://www.unpac.me/results/dc39e0a4-f9a5-4d43-b286-35a10f355aa0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56013a94edeaf931e04fc0103058f3d183f1fd9f46e4e133d6f4bb63a0826486

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 56013a94edeaf931e04fc0103058f3d183f1fd9f46e4e133d6f4bb63a0826486

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/291403/

Comments