MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68abee11f517169ce740004df98adb885c13bdfde778e7a6e6270d626a35e11f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68abee11f517169ce740004df98adb885c13bdfde778e7a6e6270d626a35e11f
SHA3-384 hash: c27a2347c575035d31d215104c9cc74c464d8d744aedf92cb3a6ba46206982f398a032cb29a4f4ba12af2a4a8fde7f1d
SHA1 hash: c460afaa95d0a8a2056a14d53aa435c879088a3f
MD5 hash: 0a1d21797c373d5372d1b0c6c45b909e
humanhash: glucose-skylark-speaker-avocado
File name:0a1d21797c373d5372d1b0c6c45b909e.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'349'637 bytes
First seen:2022-04-08 06:32:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 98304:V5C7sDeB7zx1/3vpiHa/tVC7wpIjLqI3sDw+4+zXYypl:VjeL1PvkCVMwp6GI3sDw+4sXYel
Threatray 9'184 similar samples on MalwareBazaar
TLSH T195163352E99688F3E53E04314626BB80117DFE205B22D96FF34A6D1DD9311A06738EFB
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
65.108.4.232:20762

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
65.108.4.232:20762 https://threatfox.abuse.ch/ioc/517432/

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
0a1d21797c373d5372d1b0c6c45b909e.exe
Verdict:
Malicious activity
Analysis date:
2022-04-08 06:57:09 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/0ba25e1f-5737-4201-a8a3-72da58f2d5ef

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/261869/
Detection(s):
Win.Dropper.Tiggre-9941194-0
Create hunting rule

Win.Trojan.Generic-9942096-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Running batch commands
Launching a process
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Searching for the browser window
Forced shutdown of a system process
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13058/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll update.exe
Link:
https://www.filescan.io/uploads/624fd720d53a7479dad816d8/reports/cd3676ab-ece6-4c7d-bb42-08b1e721bf9b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bc7f4fab-f8cd-43d0-98c5-bb70d6f6bd5b
Result
Threat name:
RedLine Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/972887
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
DNS related to crypt mining pools
Drops script or batch files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 605374 Sample: 2IaC3g1X4q.exe Startdate: 08/04/2022 Architecture: WINDOWS Score: 100 84 188.120.232.237, 80 THEFIRST-ASRU Russian Federation 2->84 86 185.137.234.33, 49853, 49854, 8080 SELECTELRU Russian Federation 2->86 88 2 other IPs or domains 2->88 114 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->114 116 Malicious sample detected (through community Yara rule) 2->116 118 Antivirus detection for URL or domain 2->118 120 11 other signatures 2->120 9 2IaC3g1X4q.exe 8 2->9         started        12 cmd.exe 2->12         started        14 svchost.exe 9 2 2->14         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 80 C:\Windows\Temp\setup.exe, PE32+ 9->80 dropped 82 C:\Windows\Temp\s.exe, PE32 9->82 dropped 19 s.exe 1 9->19         started        22 setup.exe 14 10 9->22         started        26 cmd.exe 2 9->26         started        28 cmd.exe 13 9->28         started        30 chrome.exe 12->30         started        32 conhost.exe 12->32         started        112 127.0.0.1 unknown unknown 14->112 file6 process7 dnsIp8 122 Multi AV Scanner detection for dropped file 19->122 124 Writes to foreign memory regions 19->124 126 Allocates memory in foreign processes 19->126 134 2 other signatures 19->134 34 AppLaunch.exe 15 8 19->34         started        39 conhost.exe 19->39         started        100 checkip.dyndns.com 193.122.6.168, 49829, 80 ORACLE-BMC-31898US United States 22->100 102 raw.githubusercontent.com 185.199.108.133, 443, 49793 FASTLYUS Netherlands 22->102 104 2 other IPs or domains 22->104 70 C:\Users\user\AppData\...\toncrypto.dll, PE32+ 22->70 dropped 72 C:\Users\user\AppData\...\WindowsFinder.exe, PE32+ 22->72 dropped 74 C:\Users\user\...\libcrypto-1_1-x64.dll, PE32+ 22->74 dropped 76 C:\Users\user\AppData\Roaming\...\OpenCL.dll, PE32+ 22->76 dropped 128 Uses schtasks.exe or at.exe to add and modify task schedules 22->128 130 Adds a directory exclusion to Windows Defender 22->130 41 schtasks.exe 22->41         started        43 schtasks.exe 22->43         started        53 4 other processes 22->53 78 C:\Users\user\AppData\Roaming\...\lol.bat, ASCII 26->78 dropped 132 Drops script or batch files to the startup folder 26->132 45 conhost.exe 26->45         started        47 chrome.exe 28->47         started        49 conhost.exe 28->49         started        51 chrome.exe 30->51         started        file9 signatures10 process11 dnsIp12 90 104.244.76.137, 4487, 49832 PONYNETUS United States 34->90 92 cdn.discordapp.com 162.159.133.233, 443, 49847 CLOUDFLARENETUS United States 34->92 94 162.159.134.233, 443, 49849 CLOUDFLARENETUS United States 34->94 66 C:\Users\user\AppData\Local\Temp\clii.exe, PE32 34->66 dropped 68 C:\Users\user\AppData\Local\Temp\bbb.exe, PE32+ 34->68 dropped 136 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 34->136 138 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 34->138 140 Tries to harvest and steal browser information (history, passwords, etc) 34->140 142 Tries to steal Crypto Currency Wallets 34->142 55 conhost.exe 41->55         started        57 conhost.exe 43->57         started        96 192.168.2.1 unknown unknown 47->96 98 239.255.255.250 unknown Reserved 47->98 59 chrome.exe 47->59         started        62 conhost.exe 53->62         started        64 conhost.exe 53->64         started        file13 signatures14 process15 dnsIp16 106 relaxtime24.biz 51.15.21.102, 443, 49783 OnlineSASFR France 59->106 108 accounts.google.com 142.250.185.77, 443, 49773 GOOGLEUS United States 59->108 110 5 other IPs or domains 59->110
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68abee11f517169ce740004df98adb885c13bdfde778e7a6e6270d626a35e11f/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-04-08 06:33:24 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncv64epvc4ljzz2aabg7tcw3rbobhpp5454opjxge4gwe2rv4epq._file
Verdict:
malicious
Similar samples:
018f2af002d120d8f1008f4050a4f25762812a8e24f9cf8c506eff6009546dc8
RedLineStealer
0d55e24824b5419c5f3e7c21d5045a7fd6df32ce1df65166dbac2684dc88b22c
RedLineStealer
2584588b0ce3b0158b0e27028874a0c2db7d644e007862d24e6013090f527dad
RedLineStealer
312783a788b6b11c7921d2836059c7beb80adcc4d4162f80bb6a3cf5d20b80c3
RedLineStealer
5013372389580672743ad71d9ec522caa057a4f7863ae8fc460ebba005121fd8
RedLineStealer
55a7d2b17477a6d16a1666e267e9bdbb1d6201b0fa07dfb20d2fb5a1b184024d
RedLineStealer
dd496554f084af7bdd9c216bdb8718cd3de154d804b8955f4894c0954dad266c
RedLineStealer
+ 9'174 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@likeajobs discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/220408-ha76bahcg5/
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine Payload
Malware Config
C2 Extraction:
104.244.76.137:4487
65.108.4.232:20762
Unpacked files
SH256 hash:
ab297fe649a2cb37d515429ea29edb44174025d778a4a522359702c07ce93d9e
MD5 hash:
1b52f35c16e1da21c8bbebf3c2eacf94
SHA1 hash:
e1a17da19258ba27011108627b82eab4be698e73
Link:
https://www.unpac.me/results/dc08bf43-b35d-4c09-b012-91baad2646ad/
SH256 hash:
ce9e387ca2690f32f8caeb83fde22cc314f064d46fc212eaf225e52611ccf7be
MD5 hash:
7437872f44e38c386789d9198a5b183c
SHA1 hash:
a0e89ad4fa78882f9d210855f905f46859cd1dfa
Link:
https://www.unpac.me/results/dc08bf43-b35d-4c09-b012-91baad2646ad/
SH256 hash:
68abee11f517169ce740004df98adb885c13bdfde778e7a6e6270d626a35e11f
MD5 hash:
0a1d21797c373d5372d1b0c6c45b909e
SHA1 hash:
c460afaa95d0a8a2056a14d53aa435c879088a3f
Link:
https://www.unpac.me/results/dc08bf43-b35d-4c09-b012-91baad2646ad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68abee11f517169ce740004df98adb885c13bdfde778e7a6e6270d626a35e11f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 68abee11f517169ce740004df98adb885c13bdfde778e7a6e6270d626a35e11f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2136936/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/261869/

Comments