MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c
SHA3-384 hash: 5b80d5cce44508f34b84ce706f3780eefeee02d3d0022887ccb2e1efe80618bbe47f865dbafb93e4d1b766110733f4c4
SHA1 hash: ab9e2ce92170b51910b602621165968c9097ec6d
MD5 hash: b3e98feff2f0b394afcdf9d9d49efb57
humanhash: sweet-echo-green-pennsylvania
File name:fortnitehack.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:338'840 bytes
First seen:2021-11-13 19:57:30 UTC
Last seen:2021-11-13 19:58:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:zV0MVCpT4w4ztCtTHZXzriJl1zaxV0JI/2Hk0:hb24FzEtTHZXzeJXz40JI/r0
Threatray 3 similar samples on MalwareBazaar
TLSH T1C574CF533AE8F618B0516D3343FB5F350FB2BDE18A32469D2A099B051B61F016DA773A
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fortnitehack.exe
Verdict:
Malicious activity
Analysis date:
2021-11-13 19:57:50 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/df5f4e67-db85-4f16-9b7d-a7f01f57722c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205539/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Connection attempt
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Sending an HTTP POST request
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %temp% directory
Reading critical registry keys
Deleting a recently created file
Sending a UDP request
Creating a file
Running batch commands
Launching a process
Unauthorized injection to a recently created process
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Downloading the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed packed
Link:
https://www.filescan.io/uploads/619018d0dec3347825a3c8ea/reports/fd929077-c410-4ede-9fae-353d6d871002/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ab39b1f-2ff8-410a-b0ba-67d2f4fd046c
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888639
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Powershell download and execute file
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected Telegram Recon
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 521110 Sample: fortnitehack.exe Startdate: 13/11/2021 Architecture: WINDOWS Score: 100 97 Antivirus detection for URL or domain 2->97 99 Sigma detected: Powershell download and execute file 2->99 101 Multi AV Scanner detection for submitted file 2->101 103 6 other signatures 2->103 13 fortnitehack.exe 14 7 2->13         started        18 services32.exe 2->18         started        process3 dnsIp4 87 antivirf.ru 81.177.141.85, 443, 49771, 49780 RTCOMM-ASRU Russian Federation 13->87 89 45.137.190.237, 27973, 49765 BITWEB-ASRU Russian Federation 13->89 91 192.168.2.1 unknown unknown 13->91 79 C:\Users\user\AppData\Local\Temp\kolopl.exe, PE32 13->79 dropped 81 C:\Users\user\...\fortnitehack.exe.log, ASCII 13->81 dropped 149 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->149 151 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->151 153 Tries to harvest and steal browser information (history, passwords, etc) 13->153 155 Tries to steal Crypto Currency Wallets 13->155 20 kolopl.exe 13->20         started        157 Multi AV Scanner detection for dropped file 18->157 159 Writes to foreign memory regions 18->159 161 Allocates memory in foreign processes 18->161 163 Creates a thread in another existing process (thread injection) 18->163 23 conhost.exe 18->23         started        file5 signatures6 process7 file8 105 Multi AV Scanner detection for dropped file 20->105 107 Adds a directory exclusion to Windows Defender 20->107 26 cmd.exe 1 20->26         started        77 C:\Windows\System32\...\sihost32.exe, PE32+ 23->77 dropped 109 Drops executables to the windows directory (C:\Windows) and starts them 23->109 29 sihost32.exe 23->29         started        signatures9 process10 signatures11 117 Suspicious powershell command line found 26->117 119 Tries to download and execute files (via powershell) 26->119 121 Adds a directory exclusion to Windows Defender 26->121 31 powershell.exe 26->31         started        33 powershell.exe 26->33         started        35 powershell.exe 26->35         started        41 4 other processes 26->41 123 Multi AV Scanner detection for dropped file 29->123 125 Writes to foreign memory regions 29->125 127 Allocates memory in foreign processes 29->127 129 Creates a thread in another existing process (thread injection) 29->129 39 conhost.exe 29->39         started        process12 dnsIp13 44 kolop.exe 31->44         started        47 kolopp.exe 33->47         started        83 antivirf.ru 35->83 73 C:\Users\user\AppData\Roaming\kolop.exe, PE32+ 35->73 dropped 85 antivirf.ru 41->85 75 C:\Users\user\AppData\Roaming\kolopp.exe, PE32 41->75 dropped 115 Powershell drops PE file 41->115 file14 signatures15 process16 dnsIp17 131 Multi AV Scanner detection for dropped file 44->131 133 Writes to foreign memory regions 44->133 135 Allocates memory in foreign processes 44->135 137 Creates a thread in another existing process (thread injection) 44->137 50 conhost.exe 44->50         started        93 ip-api.com 208.95.112.1, 49826, 80 TUT-ASUS United States 47->93 95 api.telegram.org 149.154.167.220, 443, 49827 TELEGRAMRU United Kingdom 47->95 139 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 47->139 141 May check the online IP address of the machine 47->141 53 conhost.exe 47->53         started        signatures18 process19 file20 71 C:\Windows\System32\services32.exe, PE32+ 50->71 dropped 55 cmd.exe 50->55         started        58 cmd.exe 50->58         started        process21 signatures22 111 Drops executables to the windows directory (C:\Windows) and starts them 55->111 60 services32.exe 55->60         started        63 conhost.exe 55->63         started        113 Uses schtasks.exe or at.exe to add and modify task schedules 58->113 65 conhost.exe 58->65         started        67 schtasks.exe 58->67         started        process23 signatures24 143 Writes to foreign memory regions 60->143 145 Allocates memory in foreign processes 60->145 147 Creates a thread in another existing process (thread injection) 60->147 69 conhost.exe 60->69         started        process25
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-13 19:58:08 UTC
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lelcpzcsx23qamnp7uacchg4xmq54a52vgkl3edjdqifqe4ffewa._file
Verdict:
malicious
Similar samples:
1e18bdbb00ab59d4e8692f898a0d05f4aceece07ec6a457b8705b795b732e6e5
RedLineStealer
4248b627c09a67e427dcb07d55df46103915fcccb673a422a1a6543f3bc0afa4
RedLineStealer
d3f77ae659c38c08c8c39fde6c8e5900817e2032b5b8e96de98811b00889b486
RedLineStealer
Gathering data
Unpacked files
SH256 hash:
b84f3c7f0a487d9ea617bb3eb8778ddd6de347e601b529edd8fc72e8d91570dd
MD5 hash:
656c49fe1969a6ae45a35f5af5737c00
SHA1 hash:
f0a3a64957e5d9d79fc90fcb6fea97b3b3c9fa9c
Link:
https://www.unpac.me/results/474c942e-21ff-49f4-8b7a-34a0f8ad0f18/
SH256 hash:
591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c
MD5 hash:
b3e98feff2f0b394afcdf9d9d49efb57
SHA1 hash:
ab9e2ce92170b51910b602621165968c9097ec6d
Link:
https://www.unpac.me/results/474c942e-21ff-49f4-8b7a-34a0f8ad0f18/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/591627e452be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205539/

Comments