MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6
SHA3-384 hash: 96942126f07ea31418cf9ef051e3e75a4d8a05af2dda7c03ccde151448cafc5a0fb3ec9c2c041a96f754c6a947c42816
SHA1 hash: f97fedf73131b2874e624dbdf0f6bf1a620721b1
MD5 hash: e66cd69894a5addaca7e103af4bc27a7
humanhash: robert-ack-edward-alanine
File name:TrdngAnlzr1645.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'052'240 bytes
First seen:2022-04-01 13:15:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e43149e3ea1b946c8acbdd10bc614a10 (1 x RedLineStealer)
ssdeep 24576:UZZZpppppUtXyY0Gz5HisqK5iezpGzNTS1k/9qt2utsF:UZZZpppppUsY0Gxis3wezQzNTSxHG
Threatray 2'119 similar samples on MalwareBazaar
TLSH T15725127E0F0602DCE1EF7036C46E7645BEA22FAE15615D980229742E483E12E54FF6ED
File icon (PE):PE icon
dhash icon e4eceeeeebfbefee (2 x RedLineStealer)
Reporter JAMESWT_WT
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.54214.24607.19204.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Launching a process
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/6246fb1d9253b276b7c047c2/reports/3a3df11d-6dbb-4fdb-9810-a22bde7cb0da/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76edd8e2-0e64-4c4b-b1dd-96fbc27d2c3c
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/968982
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: File Created with System Process Name
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 601469 Sample: TrdngAnlzr1645.exe Startdate: 01/04/2022 Architecture: WINDOWS Score: 100 52 Found malware configuration 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Yara detected RedLine Stealer 2->56 58 4 other signatures 2->58 6 TrdngAnlzr1645.exe 8 2->6         started        11 dllhost.exe 2->11         started        process3 dnsIp4 34 zonasertaneja.com.br 50.116.86.44, 49753, 49773, 49776 UNIFIEDLAYER-AS-1US United States 6->34 36 blackhk1.beget.tech 5.101.153.227, 49751, 80 BEGET-ASRU Russian Federation 6->36 26 C:\Users\user\AppData\Local\Temp\B69G5.exe, PE32 6->26 dropped 28 C:\Users\user\AppData\...\219FE7D8LI48K3J.exe, PE32+ 6->28 dropped 30 C:\Users\user\AppData\Local\Temp\FBI04.exe, MS-DOS 6->30 dropped 32 3 other malicious files 6->32 dropped 60 Detected unpacking (changes PE section rights) 6->60 62 Creates HTML files with .exe extension (expired dropper behavior) 6->62 64 Tries to evade debugger and weak emulator (self modifying code) 6->64 66 Hides threads from debuggers 6->66 13 F091E.exe 14 3 6->13         started        17 86K60.exe 2 6->17         started        19 9ILBC.exe 16 4 6->19         started        22 4 other processes 6->22 68 Multi AV Scanner detection for dropped file 11->68 70 Tries to detect sandboxes and other dynamic analysis tools (window names) 11->70 72 Machine Learning detection for dropped file 11->72 file5 signatures6 process7 dnsIp8 38 gumishosaled.xyz 185.45.192.228, 49787, 80 HSAE United Arab Emirates 13->38 40 api.ip.sb 13->40 74 Multi AV Scanner detection for dropped file 13->74 76 Performs DNS queries to domains with low reputation 13->76 78 Machine Learning detection for dropped file 13->78 42 185.215.113.20, 21921, 49799 WHOLESALECONNECTIONSNL Portugal 17->42 80 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 17->80 82 Tries to evade debugger and weak emulator (self modifying code) 17->82 84 Tries to steal Crypto Currency Wallets 17->84 44 yandex.ru 77.88.55.77, 443, 49784 YANDEXRU Russian Federation 19->44 46 192.168.2.1 unknown unknown 19->46 24 C:\Users\user\AppData\Roaming\...\dllhost.exe, MS-DOS 19->24 dropped 86 Detected unpacking (changes PE section rights) 19->86 88 Hides threads from debuggers 19->88 48 193.150.103.38, 49797, 80 ASGENERALTELRU Russian Federation 22->48 50 2 other IPs or domains 22->50 90 May check the online IP address of the machine 22->90 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6/
Threat name:
Win32.Trojan.Jaik
Create hunting rule
Status:
Malicious
First seen:
2022-04-01 07:46:23 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lx3qw3kdsxbwhixzpbbxgomwxtvl7ry2tmypn33tmelbwnfulpda._file
Verdict:
malicious
Similar samples:
33330133ac2e1b2dfcbc12b66276a6a61f4c4572ad4de8675f8afdabfcbb3d43
RedLineStealer
3d30ffd438512742fc01ca5df9c4b9d0deb9f908ef56e7dd3e284eec904f517d
RedLineStealer
423603734e03a0601620dfa8522bbddfc14de5418da253167f46f3a14cca4979
RedLineStealer
61c51f23cee878109b2e786c70a309d129d58edce9d5ed5caa7664b06de37bce
RedLineStealer
67e030c1c7dd08138eb1d6a12a4d652c4a304f22db556afce411c32a23bddf23
RedLineStealer
738108e1651deb6c04e05a4a2680819283433189eff93426a56e834381b5e4b5
RedLineStealer
d8a3df5d5ed44873fc091b44a64f98c6c54dae8356d747cddee51b88df9f1d2e
RedLineStealer
+ 2'109 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/220401-qhsplabgf9/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
d2846f81aaceefdd2e84d590be0501acc4f0c13a4c5bf5306c84b23d0c5ef2f2
MD5 hash:
fb4c568269cb6f5e8452e31d208cc2c6
SHA1 hash:
8ab6a8c28ec6daa2bb3ad668e7e23e6def41905c
Link:
https://www.unpac.me/results/17af10cd-613f-4101-b1d4-054622b202f3/
SH256 hash:
5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6
MD5 hash:
e66cd69894a5addaca7e103af4bc27a7
SHA1 hash:
f97fedf73131b2874e624dbdf0f6bf1a620721b1
Link:
https://www.unpac.me/results/17af10cd-613f-4101-b1d4-054622b202f3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:PowerTool
Create hunting rule
Author:@bartblaze
Description:Identifies PowerTool, sometimes used by attackers to disable security software.
Reference:https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2127016/
  
Delivery method
Distributed via web download

Comments