MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
SHA3-384 hash: 881ab2b483bd452337ed20675b982e36e9c63c573cc8925ee60567d2bff67409d172c24ddd39c696624efe9a54f88d3f
SHA1 hash: 819364784cf0d3fe440b6c9a3950de7fa093e805
MD5 hash: e16f915796d4762014fc3864d4444ac3
humanhash: illinois-sierra-low-apart
File name:e16f915796d4762014fc3864d4444ac3
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:459'776 bytes
First seen:2021-08-23 16:34:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f326f88ca83c9aacaa44acfb8884f1d4 (8 x RedLineStealer, 4 x DCRat, 2 x CoinMiner)
ssdeep 12288:K5oaqjp/9TTRxMwrxKkfk41vD1I6lgVYCAOQlgm:K5v4DTTzRtR1rOuWTQt
Threatray 1'643 similar samples on MalwareBazaar
TLSH T1A5A4E06661D020C8DAB245F6D9511B06EB7174764B21A3CF5BB853F72B1B8DA8F3C390
Reporter zbetcheckin
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e16f915796d4762014fc3864d4444ac3
Verdict:
No threats detected
Analysis date:
2021-08-23 16:37:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/14fca685-26bf-479f-b4e9-a7183e15a254

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181562/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33822938.14445.490.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process from a recently created file
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file
Deleting a recently created file
Reading critical registry keys
Unauthorized injection to a recently created process
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ad17c1fe-f8dd-491a-bb43-be19bd364c93
Result
Threat name:
DCRat Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/837701
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Creates files inside the volume driver (system volume information)
Creates multiple autostart registry keys
Creates processes via WMI
Disables security and backup related services
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected BatToExe compiled binary
Yara detected DCRat
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 470132 Sample: LrFpF5eVch Startdate: 23/08/2021 Architecture: WINDOWS Score: 100 109 Multi AV Scanner detection for submitted file 2->109 111 Yara detected DCRat 2->111 113 Yara detected Xmrig cryptocurrency miner 2->113 115 5 other signatures 2->115 10 LrFpF5eVch.exe 9 2->10         started        13 svchost.exe 2->13         started        16 svchost.exe 1 2->16         started        18 2 other processes 2->18 process3 dnsIp4 97 C:\Users\user\AppData\Local\Temp\...\extd.exe, PE32+ 10->97 dropped 20 cmd.exe 3 10->20         started        22 conhost.exe 10->22         started        107 127.0.0.1 unknown unknown 13->107 file5 process6 process7 24 build.exe 3 6 20->24         started        28 soul3ss.exe 15 32 20->28         started        31 setup.exe 20->31         started        33 7 other processes 20->33 dnsIp8 83 C:\...\runtimeperfdhcpsessioncrtcommon.exe, PE32 24->83 dropped 125 Machine Learning detection for dropped file 24->125 35 wscript.exe 24->35         started        99 188.130.139.12, 30376, 49716 ASKONTELRU Russian Federation 28->99 101 192.168.2.1 unknown unknown 28->101 103 api.ip.sb 28->103 127 Multi AV Scanner detection for dropped file 28->127 129 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 28->129 131 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->131 135 2 other signatures 28->135 37 conhost.exe 28->37         started        85 C:\Windows\Client.exe, PE32 31->85 dropped 87 C:\Users\user\AppData\Local\...\nsProcess.dll, PE32 31->87 dropped 89 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 31->89 dropped 133 Disables security and backup related services 31->133 39 cmd.exe 31->39         started        41 cmd.exe 31->41         started        43 cmd.exe 31->43         started        45 2 other processes 31->45 105 cdn.discordapp.com 162.159.135.233, 443, 49709, 49711 CLOUDFLARENETUS United States 33->105 91 C:\Users\user\AppData\Local\...\soul3ss.exe, PE32 33->91 dropped 93 C:\Users\user\AppData\Local\...\setup.exe, PE32 33->93 dropped 95 C:\Users\user\AppData\Local\...\build.exe, PE32 33->95 dropped file9 signatures10 process11 process12 47 cmd.exe 35->47         started        49 net.exe 39->49         started        51 conhost.exe 39->51         started        53 net.exe 41->53         started        55 conhost.exe 41->55         started        57 conhost.exe 43->57         started        59 sc.exe 43->59         started        61 conhost.exe 45->61         started        63 3 other processes 45->63 process13 65 runtimeperfdhcpsessioncrtcommon.exe 47->65         started        69 conhost.exe 47->69         started        71 net1.exe 49->71         started        73 net1.exe 53->73         started        file14 75 C:\...\PjmYhJmsyjLauHBDagBLQ.exe, PE32 65->75 dropped 77 C:\ProgramData\USOShared\Logs\ctfmon.exe, PE32 65->77 dropped 79 C:\Program Files (x86)\...\conhost.exe, PE32 65->79 dropped 81 3 other files (1 malicious) 65->81 dropped 117 Creates files inside the volume driver (system volume information) 65->117 119 Creates multiple autostart registry keys 65->119 121 Creates an autostart registry key pointing to binary in C:\Windows 65->121 123 Creates processes via WMI 65->123 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd/
Threat name:
Win64.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-23 16:03:50 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
19f71da28ebab8fe7256a657c603698ad607a7273e85d0e8b107269643cfa5dd
RedLineStealer
7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587
RedLineStealer
9bc6d20da16865822eb0510b8e4d26a36af0b1f7568a214b374c5c0c61d220b5
RedLineStealer
ab2851b9d96065b01a96c3305a8bbec77522b97a6c751a82a34f47f45f30af6a
RedLineStealer
ab59e845bc16961db7c3f2f8249083cff0098b263dc37b7d2819b223153d2ebe
RedLineStealer
b88350726e9a1dc492b8fde7c03fdd0f5c7669b6919e1c25ddbcb8a69125c330
RedLineStealer
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877fc0ed68a983d3191a37
RedLineStealer
cfcb21c8c129c8c2c525ecfac8bd883260eda6038e3991210765e582007451dd
RedLineStealer
ea07ac0be9b5d757b3d6eab704606fb022770451be04c729af03f3a0941d3fc8
RedLineStealer
f98183a2ad674f8aae6ad47e7da8b48c80175148ba333f0f57b3e6eca64bfaa6
RedLineStealer
+ 1'633 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@soul3ss discovery infostealer spyware stealer upx
Link:
https://tria.ge/reports/210823-sxww8tad2n/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
RedLine
RedLine Payload
Malware Config
C2 Extraction:
188.130.139.12:30376
Unpacked files
SH256 hash:
65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd
MD5 hash:
e16f915796d4762014fc3864d4444ac3
SHA1 hash:
819364784cf0d3fe440b6c9a3950de7fa093e805
Link:
https://www.unpac.me/results/a4e173df-03cf-4e57-93c8-96234f7b6bbc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 65dee75f5d4f0d7e0c1065a689ebe79f67c87a4d3d9654193164128e859a0ddd

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181562/
  
URLhaus
https://urlhaus.abuse.ch/url/1557729/

Comments