MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f
SHA3-384 hash: 787fe1862ccff4b70524b1e341cb84aab57267883210d41cddb9d227815dffc9e2c5d9163b9d072388388795ee0fc066
SHA1 hash: 4cd478c2694405586413f0c048320dba455236f5
MD5 hash: 7acf8b2fa26f46aaca0493c5932143cf
humanhash: december-bakerloo-east-uranus
File name:Glory Hack.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:940'424 bytes
First seen:2022-01-06 17:54:10 UTC
Last seen:2022-01-06 19:42:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:tO4Dj0ZFVWCR4pk4lZZsZZPQ0JQkf3zhA4IuamnxuXDeoz+LGzi+9hHlt:/jvt0JlDxuXbzXBH
Threatray 1'019 similar samples on MalwareBazaar
TLSH T17D15F8DE52C19849CDEE27F00DFBA89CAD7194C6938763EAA32C95F06B423D3254D5E0
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Glory Hack.exe
Verdict:
Malicious activity
Analysis date:
2022-01-06 17:56:34 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/4e801eee-ab88-43d1-8805-78c055e95901

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/217587/
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILZilla.12374.27605.5681.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated overlay packed
Link:
https://www.filescan.io/uploads/61d72cfb02e388f9fdb08331/reports/a5d583e2-1dd1-404b-806f-7abfb3ff614b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bbe6fd35-9f39-47e3-89a7-993aedaaa38f
Result
Threat name:
Clipboard Hijacker Phoenix Miner Raccoon
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/916429
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL side loading technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected Phoenix Miner
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 548907 Sample: Glory Hack.exe Startdate: 06/01/2022 Architecture: WINDOWS Score: 100 132 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->132 134 Antivirus detection for URL or domain 2->134 136 Multi AV Scanner detection for submitted file 2->136 138 9 other signatures 2->138 10 Glory Hack.exe 3 2->10         started        14 RegHost.exe 2->14         started        16 RegHost.exe 2->16         started        18 oobeldr.exe 2->18         started        process3 file4 104 C:\Users\user\AppData\...behaviorgraphlory Hack.exe.log, ASCII 10->104 dropped 168 Writes to foreign memory regions 10->168 170 Injects a PE file into a foreign processes 10->170 20 RegAsm.exe 15 11 10->20         started        172 Detected unpacking (changes PE section rights) 14->172 174 Detected unpacking (overwrites its own PE header) 14->174 176 Allocates memory in foreign processes 14->176 25 conhost.exe 14->25         started        27 bfsvc.exe 14->27         started        178 Hides threads from debuggers 16->178 29 conhost.exe 16->29         started        31 bfsvc.exe 16->31         started        33 schtasks.exe 18->33         started        signatures5 process6 dnsIp7 106 c9d0e790b353537889bd47a364f5acff43c11f245.xyz 185.112.83.97, 49759, 80 SUPERSERVERSDATACENTERRU Russian Federation 20->106 108 github.com 140.82.121.3, 443, 49782 GITHUBUS United States 20->108 110 4 other IPs or domains 20->110 96 C:\Users\user\AppData\Roaming\whw.exe, PE32 20->96 dropped 98 C:\Users\user\AppData\Roaming\safas2f.exe, PE32+ 20->98 dropped 100 C:\Users\user\AppData\Roaming\e3dwefw.exe, PE32 20->100 dropped 102 2 other malicious files 20->102 dropped 160 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->160 162 Performs DNS queries to domains with low reputation 20->162 164 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 20->164 35 safas2f.exe 1 2 20->35         started        39 clipper.exe 20->39         started        41 rebild.exe 20->41         started        45 2 other processes 20->45 43 conhost.exe 33->43         started        file8 signatures9 process10 dnsIp11 92 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 35->92 dropped 140 Detected unpacking (changes PE section rights) 35->140 142 Detected unpacking (overwrites its own PE header) 35->142 144 Injects code into the Windows Explorer (explorer.exe) 35->144 158 3 other signatures 35->158 48 bfsvc.exe 1 35->48         started        52 conhost.exe 35->52         started        54 curl.exe 1 35->54         started        57 explorer.exe 35->57         started        146 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 39->146 148 Writes to foreign memory regions 39->148 150 Allocates memory in foreign processes 39->150 59 AppLaunch.exe 39->59         started        61 WerFault.exe 39->61         started        152 Creates a thread in another existing process (thread injection) 41->152 63 conhost.exe 41->63         started        120 45.147.196.146, 49828, 6213 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 45->120 94 C:\Users\user\AppData\Roaming\...\oobeldr.exe, PE32 45->94 dropped 154 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 45->154 156 Uses schtasks.exe or at.exe to add and modify task schedules 45->156 65 schtasks.exe 1 45->65         started        file12 signatures13 process14 dnsIp15 80 \Device\ConDrv, ASCII 48->80 dropped 122 Hides threads from debuggers 48->122 67 conhost.exe 48->67         started        112 api.telegram.org 149.154.167.220, 443, 49766 TELEGRAMRU United Kingdom 54->112 69 conhost.exe 54->69         started        114 185.163.204.24, 49826, 80 CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE Germany 59->114 116 5.181.156.155, 49825, 80 MIVOCLOUDMD Moldova Republic of 59->116 118 2 other IPs or domains 59->118 82 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 59->82 dropped 84 C:\Users\user\AppData\...\vcruntime140.dll, PE32 59->84 dropped 86 C:\Users\user\AppData\...\ucrtbase.dll, PE32 59->86 dropped 90 30 other files (none is malicious) 59->90 dropped 124 Tries to steal Mail credentials (via file / registry access) 59->124 126 Tries to harvest and steal browser information (history, passwords, etc) 59->126 128 DLL side loading technique detected 59->128 88 C:\Windows\System32\refjgi.exe, PE32+ 63->88 dropped 130 Adds a directory exclusion to Windows Defender 63->130 71 cmd.exe 63->71         started        74 conhost.exe 65->74         started        file16 signatures17 process18 signatures19 166 Adds a directory exclusion to Windows Defender 71->166 76 conhost.exe 71->76         started        78 powershell.exe 71->78         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-06 17:55:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mnuaznimutdoywbx3pcfvgsy7gzh7uz7wr7dpzhijarf2dikd4xq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
016c36da3c46c38f9bc18970acf60b437503e15139fd1047f4b73cdad4d6342a
RedLineStealer
1bbee1727c791557b1119c32a93c58964414a1cce3dcc0601f92bb628e033a59
RedLineStealer
22c3fa70f641f2b75a8b0cdd6cab763c2b968e88318bac611f1a002022aeca39
RedLineStealer
50c5913eb4e35d0676563b4f4dbe9111dfef559c11a8acdb378e7049979c4dca
RedLineStealer
51e9b8fc3cf6581560a4075eb9cc9923aadf3760de21d79639b93b74ff41aab7
RedLineStealer
92ccbbead3ca1c2a221c3dd06da16bb15fe6aef02859087c09c7d248017d955d
RedLineStealer
932fda59abbce6378d0637c359b61b0747c9602e2e87d3105bb49ad745ed382e
RedLineStealer
ba1d27e1521b29f5fabc05094b177131f356588ce26b2e5336910df2bd1cc919
RedLineStealer
e670a645b65e5a4deadb6d555fa4f2bc88ef92a5e9657419f410bd1cc076f407
RedLineStealer
ec031c507f1d160b228a5de8719daecb7db5cbc18bf41b90f77d79678b4dbcb7
RedLineStealer
+ 1'009 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:redline family:xmrig botnet:cheat discovery infostealer miner persistence spyware stealer
Link:
https://tria.ge/reports/220106-whfypabea6/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
xmrig
Malware Config
C2 Extraction:
45.147.196.146:6213
Unpacked files
SH256 hash:
63051828a94d29358579e564adf81725e80f4ac3b40070d8e8829e61a0f9cc01
MD5 hash:
ab3dabbf479d615d6dd1667baf0d67b7
SHA1 hash:
1b8cca4fa2d4302f490812572111869468fcd94d
Link:
https://www.unpac.me/results/6831dab7-21c2-44fc-b21b-773b15fc7492/
SH256 hash:
63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f
MD5 hash:
7acf8b2fa26f46aaca0493c5932143cf
SHA1 hash:
4cd478c2694405586413f0c048320dba455236f5
Link:
https://www.unpac.me/results/6831dab7-21c2-44fc-b21b-773b15fc7492/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/63680cb50ca4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 63680cb50ca4c6ec5837dbc45a9a58f9b27fd33fb47e37e4e848225d0d0a1f2f

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/217587/

Comments