MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cf145c4d5e12d5d49d42d41b38aef83a61553d47c455f048eb3195c2e983945. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cf145c4d5e12d5d49d42d41b38aef83a61553d47c455f048eb3195c2e983945
SHA3-384 hash: 40906ec5867c329426e278121ad6d29c0f5d2df400935fcd53a8353563ff3e2a366f49490f7ae38d989835d4cbbabc0d
SHA1 hash: 42c569ce3bdd934fd71270f564252fb66c8085ed
MD5 hash: 4ef152ab872fa6159d310cb8b6b97c47
humanhash: hamper-one-green-potato
File name:4ef152ab872fa6159d310cb8b6b97c47.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:261'648 bytes
First seen:2022-09-16 19:15:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f51a3a1d6f890b4697617aa0627f8f3 (2 x RedLineStealer)
ssdeep 6144:/78FL164SRd6fDPTHIpiMEe1W4Jwtv3VDK5YoLtqjEHM4c:/78FL1ZPTHuiMEe1W4elFKumtqjsMv
Threatray 69 similar samples on MalwareBazaar
TLSH T1DA44AEC039B4D533D17D3D3606E1BE326A1EEBB16B56BEAB630701250A70543C58BB6B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
77.73.134.27:8163

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
77.73.134.27:8163 https://threatfox.abuse.ch/ioc/850076/

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
4ef152ab872fa6159d310cb8b6b97c47.exe
Verdict:
Malicious activity
Analysis date:
2022-09-16 19:24:43 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/76bee8a0-3af9-481e-b5da-3c6ca4ef0e53

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/310668/
Detection(s):
Win.Malware.Lazy-9968596-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/37959/overview
Behaviour
MalwareBazaar
CheckNumberOfProcessor
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6324cba4ba7b8113dd6bc079/reports/6c64e727-256f-49ee-9eff-dd61ffba16a1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/56dcb251-ef8c-488c-b854-b1122e114880
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1071938
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Hides threads from debuggers
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 704480 Sample: cRUW1e4q7T.exe Startdate: 16/09/2022 Architecture: WINDOWS Score: 100 92 Snort IDS alert for network traffic 2->92 94 Multi AV Scanner detection for domain / URL 2->94 96 Malicious sample detected (through community Yara rule) 2->96 98 5 other signatures 2->98 11 cRUW1e4q7T.exe 2->11         started        14 MoUSO.exe 2->14         started        process3 signatures4 136 Contains functionality to inject code into remote processes 11->136 138 Writes to foreign memory regions 11->138 140 Allocates memory in foreign processes 11->140 142 Injects a PE file into a foreign processes 11->142 16 AppLaunch.exe 15 7 11->16         started        21 WerFault.exe 23 9 11->21         started        144 Antivirus detection for dropped file 14->144 146 Detected unpacking (changes PE section rights) 14->146 148 Tries to detect sandboxes and other dynamic analysis tools (window names) 14->148 150 5 other signatures 14->150 process5 dnsIp6 82 77.73.134.27, 49713, 8163 FIBEROPTIXDE Kazakhstan 16->82 84 transfer.sh 144.76.136.153, 443, 49714, 49715 HETZNER-ASDE Germany 16->84 86 192.168.2.1 unknown unknown 16->86 68 C:\Users\user\AppData\Local\...\up_setup.exe, PE32+ 16->68 dropped 100 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->100 102 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->102 104 Tries to harvest and steal browser information (history, passwords, etc) 16->104 106 Tries to steal Crypto Currency Wallets 16->106 23 up_setup.exe 1 16->23         started        70 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 21->70 dropped file7 signatures8 process9 signatures10 122 Hijacks the control flow in another process 23->122 124 Writes to foreign memory regions 23->124 126 Allocates memory in foreign processes 23->126 128 2 other signatures 23->128 26 AppLaunch.exe 15 23->26         started        30 conhost.exe 23->30         started        process11 dnsIp12 90 transfer.sh 26->90 78 C:\Users\user\AppData\Local\...\wsetupo.exe, PE32 26->78 dropped 80 C:\Users\user\AppData\Local\Temp\wsetup.exe, PE32+ 26->80 dropped 32 wsetupo.exe 26->32         started        37 wsetup.exe 1 26->37         started        file13 process14 dnsIp15 88 dba692117be7b6d3480fe5220fdd58b38bf.xyz 104.21.17.54, 443, 49717, 49720 CLOUDFLARENETUS United States 32->88 72 C:\Users\user\AppData\Local\cache\MoUSO.exe, PE32 32->72 dropped 108 Antivirus detection for dropped file 32->108 110 Detected unpacking (changes PE section rights) 32->110 112 Found evasive API chain (may stop execution after checking mutex) 32->112 120 8 other signatures 32->120 39 schtasks.exe 32->39         started        74 C:\Windows\System32\drivers\etc\hosts, data 37->74 dropped 76 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 37->76 dropped 114 Query firmware table information (likely to detect VMs) 37->114 116 Modifies the hosts file 37->116 118 Adds a directory exclusion to Windows Defender 37->118 41 cmd.exe 1 37->41         started        44 cmd.exe 37->44         started        46 powershell.exe 37->46         started        48 2 other processes 37->48 file16 signatures17 process18 signatures19 50 conhost.exe 39->50         started        130 Uses cmd line tools excessively to alter registry or file data 41->130 132 Uses powercfg.exe to modify the power settings 41->132 134 Modifies power options to not sleep / hibernate 41->134 52 conhost.exe 41->52         started        54 sc.exe 41->54         started        62 9 other processes 41->62 56 conhost.exe 44->56         started        64 4 other processes 44->64 66 2 other processes 46->66 58 conhost.exe 48->58         started        60 conhost.exe 48->60         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cf145c4d5e12d5d49d42d41b38aef83a61553d47c455f048eb3195c2e983945/
Threat name:
Win32.Infostealer.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-12 19:39:12 UTC
File Type:
PE (Exe)
AV detection:
25 of 40 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntyulrgv4ewv2soufva3hcxpqotbku6uprcv6beowmmvyluyhfcq._file
Verdict:
malicious
Similar samples:
08e913af4a86466aea86203b3a75fe51cf8765fd72c76f8f9a402d42d61c70e2
RedLineStealer
19c3401042baeac38e94c3105dbfc1249697741f242db3f51f52eebb45c92ad9
RedLineStealer
1e22f169b729cc87b087ff2e6ee871b7c82edfc9dd2055a17d0ebf4ca2310600
RedLineStealer
21665567315ac5983cee460bae1e45fb69b71c1ea809fd56bcd9357c1adc632d
RedLineStealer
aadcd7f826198c71e998d31ae4ddd4f219d61ed27338ab7aec0c055749f1bc24
RedLineStealer
cad30ad3dc657a39b8e8625ed7d40ae81f4ad7808021758ddbed1990227403e9
RedLineStealer
d273fc08938b54321f5d01dfa9200573efdf9d6fb9a2daf038aedd9d1f85ad65
RedLineStealer
f460aba4130701652e226e6059f5501065b6e6673ffb72aea0a1918af1c6a922
RedLineStealer
+ 59 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220916-xyssvsgea3/
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7f4dd39c-e267-48bb-8992-1bc062acc798
Unpacked files
SH256 hash:
6cf145c4d5e12d5d49d42d41b38aef83a61553d47c455f048eb3195c2e983945
MD5 hash:
4ef152ab872fa6159d310cb8b6b97c47
SHA1 hash:
42c569ce3bdd934fd71270f564252fb66c8085ed
Detections:
win_vigilant_cleaner_auto
Create hunting rule
Link:
https://www.unpac.me/results/f112dba9-c3b1-4fa3-b840-bbb6e9aead53/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6cf145c4d5e12d5d49d42d41b38aef83a61553d47c455f048eb3195c2e983945

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Record_Breaker_Similarities
Create hunting rule
Author:DigitalPanda
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_vigilant_cleaner_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vigilant_cleaner.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/310668/

Comments