MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 663cd192b8b4836d21f703147a141630457f213d200590df047faea9c7d1d5f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 663cd192b8b4836d21f703147a141630457f213d200590df047faea9c7d1d5f2
SHA3-384 hash: 82f75823a2ff3157e6a0ca9dcc5703d2af08b96d49af36cfb98fc5c1383c644c0ae1a3a2e876464535bc639ed69fd357
SHA1 hash: d44aa416f6527283c2a8f88082788d5ef485c2ac
MD5 hash: 5426b97855f84751c1f6d89fb9d34e39
humanhash: xray-michigan-four-fourteen
File name:5426b97855f84751c1f6d89fb9d34e39.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:351'640 bytes
First seen:2021-11-12 11:00:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:PLWzsW/E48KE1VaOm6dHOdHKJM25/+Jbp+sIiOkm:TWQ+E2EDmMCKx/+Jbp2km
Threatray 292 similar samples on MalwareBazaar
TLSH T1F974E1032D4EF718F0E63E3742DF49564FA61EE19B728A867E099B011153E416EF3B29
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
212.86.102.63:62907

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
212.86.102.63:62907 https://threatfox.abuse.ch/ioc/246887/

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205273/
Detection(s):
Win.Malware.Agent-9907175-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed packed
Link:
https://www.filescan.io/uploads/618e497adec3347825a2b3c4/reports/e2c94a8a-53ff-441a-ad6c-3ddd0c75e2dd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3b0a73e-fd68-4048-a848-71ba13598a24
Result
Threat name:
BitCoin Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888048
Signature
Allocates memory in foreign processes
Connects to many ports of the same IP (likely port scanning)
Creates a thread in another existing process (thread injection)
Drops PE files to the user root directory
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 520521 Sample: jaBNV5YvmB.exe Startdate: 12/11/2021 Architecture: WINDOWS Score: 100 65 Found malware configuration 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 Yara detected BitCoin Miner 2->69 71 5 other signatures 2->71 13 jaBNV5YvmB.exe 3 2->13         started        17 services32.exe 2->17         started        process3 file4 57 C:\Users\user\AppData\...\jaBNV5YvmB.exe.log, ASCII 13->57 dropped 99 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->99 101 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->101 19 jaBNV5YvmB.exe 15 6 13->19         started        103 Writes to foreign memory regions 17->103 105 Allocates memory in foreign processes 17->105 107 Creates a thread in another existing process (thread injection) 17->107 24 conhost.exe 3 17->24         started        signatures5 process6 dnsIp7 63 91.243.32.23, 12780, 49743, 49746 MATTEOGB Russian Federation 19->63 55 C:\Users\user\AppData\Local\Temp\sys32.exe, PE32+ 19->55 dropped 83 Tries to harvest and steal browser information (history, passwords, etc) 19->83 85 Tries to steal Crypto Currency Wallets 19->85 26 sys32.exe 19->26         started        file8 signatures9 process10 signatures11 93 Writes to foreign memory regions 26->93 95 Allocates memory in foreign processes 26->95 97 Creates a thread in another existing process (thread injection) 26->97 29 conhost.exe 4 26->29         started        process12 file13 59 C:\Users\user\services32.exe, PE32+ 29->59 dropped 109 Drops PE files to the user root directory 29->109 33 cmd.exe 1 29->33         started        35 cmd.exe 1 29->35         started        signatures14 process15 signatures16 38 services32.exe 33->38         started        41 conhost.exe 33->41         started        81 Uses schtasks.exe or at.exe to add and modify task schedules 35->81 43 conhost.exe 35->43         started        45 schtasks.exe 1 35->45         started        process17 signatures18 87 Writes to foreign memory regions 38->87 89 Allocates memory in foreign processes 38->89 91 Creates a thread in another existing process (thread injection) 38->91 47 conhost.exe 4 38->47         started        process19 file20 61 C:\Users\user\AppData\...\sihost32.exe, PE32+ 47->61 dropped 50 sihost32.exe 47->50         started        process21 signatures22 73 Multi AV Scanner detection for dropped file 50->73 75 Writes to foreign memory regions 50->75 77 Allocates memory in foreign processes 50->77 79 Creates a thread in another existing process (thread injection) 50->79 53 conhost.exe 2 50->53         started        process23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/663cd192b8b4836d21f703147a141630457f213d200590df047faea9c7d1d5f2/
Threat name:
ByteCode-MSIL.Trojan.RedLineSteal
Create hunting rule
Status:
Malicious
First seen:
2021-11-09 23:57:27 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=my6ndevywsbw2ipxamkhufawgbcx6ij5eaczbxyep6xktr6r2xza._file
Verdict:
malicious
Similar samples:
191018b2c61b46c04fba2acfd7138621ad327b5e918bee60e551c466aa9aca33
RedLineStealer
28f5fb04e33ee8f3257b1a2c6f4ade3f281b0d474eea4bdde2abe622a1b11994
RedLineStealer
58f64e4083fa288b091dc0d29a050da9cd09e4ee6607aff2e5fa5ffbe2c7a887
RedLineStealer
8b808185dc8cc0b23c275ce6b8d384814d37ccec8a842e1e8702f63e76de843c
RedLineStealer
ad7c5a0fb3bcfafed608b33c38ce110e50aa4158906abfc8092a660b6b2ea133
RedLineStealer
b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277
RedLineStealer
f89908f8594a0dccfb5e52b295075ff63be86c0f5584f990d39dfe2b2c2f9c08
RedLineStealer
f9194db6a27bfd9322186caf3fa8337f6b5197301798818920e84724362ee801
RedLineStealer
+ 282 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211112-m4j3ssdcb7/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
91.243.32.23:12780
Unpacked files
SH256 hash:
a93d7c73b64f0b81939b9d018e703c05891402b19787f25eb205bd252a73da0e
MD5 hash:
cf1dec33ce01567dc913ad6af57ce04f
SHA1 hash:
971b9b93fac64f81d9cb7f426141d31dd60a72ff
Link:
https://www.unpac.me/results/fdba6974-19ac-4e4f-8b67-e6803c8f4eed/
SH256 hash:
663cd192b8b4836d21f703147a141630457f213d200590df047faea9c7d1d5f2
MD5 hash:
5426b97855f84751c1f6d89fb9d34e39
SHA1 hash:
d44aa416f6527283c2a8f88082788d5ef485c2ac
Link:
https://www.unpac.me/results/fdba6974-19ac-4e4f-8b67-e6803c8f4eed/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/663cd192b8b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/663cd192b8b4836d21f703147a141630457f213d200590df047faea9c7d1d5f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/205273/

Comments