MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aaecc91eecab8970deeef790df826ad10dd5fb4a40695b1143b9a84773c3223. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aaecc91eecab8970deeef790df826ad10dd5fb4a40695b1143b9a84773c3223
SHA3-384 hash: f5cd5b659d1b386edb32db7682678dda2f4f44ed975da032b3a9e372720cbb70d6837f93cd625df8261c5de546e0bb7d
SHA1 hash: bac9eecac4394018711f1216167e447ee700118e
MD5 hash: 89a8035700e40ac033e192817b522405
humanhash: ohio-asparagus-nuts-johnny
File name:Setup.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'799'552 bytes
First seen:2022-02-10 19:42:17 UTC
Last seen:2022-02-10 21:59:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 41304e4befbbd8a63ad6ec59f252160b (56 x RedLineStealer, 4 x RaccoonStealer, 2 x CoinMiner)
ssdeep 98304:kmaOV16pu6TldYxB1O8RHqG9TfQjrnJymI:kmJDSpe7RHjTI3nJPI
Threatray 1'240 similar samples on MalwareBazaar
TLSH T1BE0633001DE4E4A8E70C4DB8B7BF216BAE55B270555F249C0FA8D5699CAE340A73FD38
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/240749/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Using the Windows Management Instrumentation requests
DNS request
Creating a window
Reading critical registry keys
Сreating synchronization primitives
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Creating a process with a hidden window
Sending a TCP request to an infection source
Stealing user critical data
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
overlay packed raccoon
Link:
https://www.filescan.io/uploads/62056ad154047500bb3c9845/reports/b0298b08-c5ab-42af-b90a-28cfb08ce581/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aae943a4-b276-4045-b938-128a78aacb8c
Result
Threat name:
RedLine lolMiner Downloader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/937922
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected lolMiner Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 570397 Sample: Setup.exe Startdate: 10/02/2022 Architecture: WINDOWS Score: 100 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 Antivirus detection for URL or domain 2->102 104 9 other signatures 2->104 10 Setup.exe 2->10         started        13 RegHost.exe 2->13         started        process3 signatures4 112 Writes to foreign memory regions 10->112 114 Allocates memory in foreign processes 10->114 116 Tries to detect virtualization through RDTSC time measurements 10->116 118 Injects a PE file into a foreign processes 10->118 15 AppLaunch.exe 15 7 10->15         started        20 WerFault.exe 2 9 10->20         started        22 WerFault.exe 23 9 10->22         started        24 WerFault.exe 9 10->24         started        120 Machine Learning detection for dropped file 13->120 122 Injects code into the Windows Explorer (explorer.exe) 13->122 124 Modifies the context of a thread in another process (thread injection) 13->124 26 explorer.exe 13->26         started        28 bfsvc.exe 13->28         started        30 conhost.exe 13->30         started        process5 dnsIp6 84 91.243.59.37, 49763, 61742 MATTEOGB Russian Federation 15->84 86 cdn.discordapp.com 162.159.135.233, 443, 49775 CLOUDFLARENETUS United States 15->86 66 C:\Users\user\AppData\Local\Temp\dffdf.exe, PE32+ 15->66 dropped 90 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->90 92 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->92 94 Tries to harvest and steal browser information (history, passwords, etc) 15->94 96 Tries to steal Crypto Currency Wallets 15->96 32 dffdf.exe 1 4 15->32         started        88 192.168.2.1 unknown unknown 20->88 68 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->68 dropped 70 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->70 dropped 72 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 24->72 dropped 37 curl.exe 26->37         started        39 conhost.exe 26->39         started        41 conhost.exe 28->41         started        file7 signatures8 process9 dnsIp10 80 185.137.234.33, 49777, 8080 SELECTELRU Russian Federation 32->80 74 C:\Users\user\AppData\...\RegModule.exe, PE32+ 32->74 dropped 76 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 32->76 dropped 78 C:\Users\user\AppData\Roaming\...\RegData.exe, PE32+ 32->78 dropped 106 Machine Learning detection for dropped file 32->106 108 Injects code into the Windows Explorer (explorer.exe) 32->108 110 Modifies the context of a thread in another process (thread injection) 32->110 43 explorer.exe 32->43         started        45 curl.exe 1 32->45         started        48 bfsvc.exe 32->48         started        50 conhost.exe 32->50         started        52 conhost.exe 37->52         started        file11 signatures12 process13 dnsIp14 54 curl.exe 43->54         started        56 conhost.exe 43->56         started        58 curl.exe 43->58         started        82 api.telegram.org 149.154.167.220, 443, 49778 TELEGRAMRU United Kingdom 45->82 60 conhost.exe 45->60         started        62 conhost.exe 48->62         started        process15 process16 64 conhost.exe 54->64         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5aaecc91eecab8970deeef790df826ad10dd5fb4a40695b1143b9a84773c3223/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 05:05:31 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkxmzepozk4jodpo554q36bgvuin2x5uuqdjlmiuhonii5z4girq._file
Verdict:
malicious
Similar samples:
0728f943b4d7f7e947f391aa5e77dec66a8208041aac22e70cfc9ed4a4a5d027
RedLineStealer
2c7e8a9b546f7c133469fabcfc200e5ab79da84ffa180fda9e088bc5476af860
RedLineStealer
374ec0de5ab31bc54adc80e494194f0070a78839701d19b73b27ca605f05c768
RedLineStealer
3dc72b0f754bdd940a27033839a6b08c7ac6a41259a92764638194afe3e969de
RedLineStealer
4fa28556557b228a0cabb6a51597217e09afdf58a140b1181f0bd8325e6e4d0f
RedLineStealer
5017901794c5147a06624b1f03292d87b0dfd6662569ce397fad912369c583b1
RedLineStealer
6e60006ac8af12483aee2b0f6bcf0a963a0423b494b55f56ad51bfc9b3a3bd71
RedLineStealer
790b75e1d50978e41ae57a87008b3d1922d3efd15924b59a2a0967f29abdab8a
RedLineStealer
a085e4af6a5b200d9cfe44c811c7f40e7f275122c5ae62b204835bbd6d7b1e05
RedLineStealer
+ 1'230 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220210-ye8weaagej/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
035bd78fc4deaa59220010a32ebfdd50cdf3f2f9141078cc144743ef44fa8b9d
MD5 hash:
7e180315e36c69d05ca4428c2631f0be
SHA1 hash:
0f7aeafb133f16f5e984844d9427e39d818651d4
Link:
https://www.unpac.me/results/39fa386a-42cc-43fd-943a-8bd55bcd64e7/
SH256 hash:
5aaecc91eecab8970deeef790df826ad10dd5fb4a40695b1143b9a84773c3223
MD5 hash:
89a8035700e40ac033e192817b522405
SHA1 hash:
bac9eecac4394018711f1216167e447ee700118e
Link:
https://www.unpac.me/results/39fa386a-42cc-43fd-943a-8bd55bcd64e7/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:downloader_macros
Create hunting rule
Author:ddvvmmzz
Description:downloader macros
Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:obfuscate_macros
Create hunting rule
Author:ddvvmmzz
Description:obfuscate macros
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 5aaecc91eecab8970deeef790df826ad10dd5fb4a40695b1143b9a84773c3223

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/240749/

Comments