MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d0429bb3533ea8cd3b10d207ec5505ac0d38692f7f4cd1375db7cd1aba0be6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d0429bb3533ea8cd3b10d207ec5505ac0d38692f7f4cd1375db7cd1aba0be6e
SHA3-384 hash: 28fc0b3759406905652cccf5039f7c642362cf01f15651044add573940af7a88b14c3651d1a50096bdc428f79fa8c35f
SHA1 hash: b26d85c039149f3cdb534332d9054bf8b193475b
MD5 hash: 3c4423af11c238b361c08011535d9533
humanhash: nine-zebra-ten-table
File name:3c4423af11c238b361c08011535d9533.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'641'020 bytes
First seen:2022-09-24 05:00:38 UTC
Last seen:2022-09-24 05:57:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 98304:kukce9dkNs9NYbU6s5H7TpB/c7Zx+XFjBFoKa:kukce9dkuzYbls5Lc7X+2p
TLSH T1EFF5EF51BD085845FCA11278CD29CAB8E2527EC53560A2A601EFFE7BF5BB343CB5D182
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 275e1f4de709361b (1 x Formbook, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
195.201.44.44:37397

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
195.201.44.44:37397 https://threatfox.abuse.ch/ioc/851458/

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312755/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.28157.32090.3323.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Creating a process from a recently created file
Сreating synchronization primitives
Searching for the window
Launching a process
Using the Windows Management Instrumentation requests
Running batch commands
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/38695/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/632e8f893c00655b268cbb38/reports/76b6c52f-0938-4d99-a590-ff86c01ff86c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a2c1d114-05a7-43ec-8d83-f216cc07595d
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1076286
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Creates files in the system32 config directory
Downloads files with wrong headers with respect to MIME Content-Type
Found hidden mapped module (file has been removed from disk)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 708828 Sample: oJKDPoQWiF.exe Startdate: 24/09/2022 Architecture: WINDOWS Score: 100 77 Snort IDS alert for network traffic 2->77 79 Malicious sample detected (through community Yara rule) 2->79 81 Antivirus / Scanner detection for submitted sample 2->81 83 7 other signatures 2->83 8 oJKDPoQWiF.exe 9 2->8         started        11 updater.exe 2->11         started        process3 file4 69 C:\Users\...\setup_1663356452.7719157.exe, PE32 8->69 dropped 14 setup_1663356452.7719157.exe 1 8->14         started        17 344.exe 1 8->17         started        71 C:\Windows\Temp\CA30.tmp, PE32+ 11->71 dropped 85 Writes to foreign memory regions 11->85 87 Modifies the context of a thread in another process (thread injection) 11->87 89 Adds a directory exclusion to Windows Defender 11->89 91 Maps a DLL or memory area into another process 11->91 20 cmd.exe 11->20         started        22 powershell.exe 11->22         started        24 powershell.exe 11->24         started        26 2 other processes 11->26 signatures5 process6 file7 93 Multi AV Scanner detection for dropped file 14->93 95 Writes to foreign memory regions 14->95 97 Injects a PE file into a foreign processes 14->97 28 AppLaunch.exe 15 7 14->28         started        33 conhost.exe 14->33         started        67 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 17->67 dropped 99 Adds a directory exclusion to Windows Defender 17->99 35 cmd.exe 1 17->35         started        37 powershell.exe 17 17->37         started        43 3 other processes 17->43 101 Uses cmd line tools excessively to alter registry or file data 20->101 45 11 other processes 20->45 103 Creates files in the system32 config directory 22->103 39 conhost.exe 22->39         started        41 conhost.exe 24->41         started        47 2 other processes 26->47 signatures8 process9 dnsIp10 75 boardparty.xyz 195.201.44.44, 37397, 49702, 49703 HETZNER-ASDE Germany 28->75 73 C:\Users\user\AppData\Roaming\vs19.exe, PE32+ 28->73 dropped 105 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 28->105 107 Performs DNS queries to domains with low reputation 28->107 109 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->109 115 2 other signatures 28->115 49 vs19.exe 28->49         started        111 Uses cmd line tools excessively to alter registry or file data 35->111 51 conhost.exe 35->51         started        53 sc.exe 35->53         started        55 sc.exe 35->55         started        63 8 other processes 35->63 113 Uses schtasks.exe or at.exe to add and modify task schedules 37->113 57 conhost.exe 37->57         started        59 conhost.exe 43->59         started        65 4 other processes 43->65 61 conhost.exe 47->61         started        file11 signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d0429bb3533ea8cd3b10d207ec5505ac0d38692f7f4cd1375db7cd1aba0be6e/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-17 22:04:06 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nucctozvgpvizu5rbuqh5rkqllanhbus672m2e3v3n6ndk5axzxa._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:936793099_99 evasion infostealer spyware
Link:
https://tria.ge/reports/220924-fnjnrsaeh8/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Drops startup file
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Stops running service(s)
Modifies security service
RedLine
RedLine payload
Malware Config
C2 Extraction:
boardparty.xyz:37397
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/48e084fa-a893-4af8-b7ab-3c0744d0a8ba
Unpacked files
SH256 hash:
202307292608adce12c3a52502313c7b934d82ef18e31d402513a25c5f74e3cc
MD5 hash:
3453ccdc33898e1b623dfb5989560c0d
SHA1 hash:
66c0fa6e364d946c94c70209103f146280d5dcdd
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/97c97c52-98ee-4af9-a554-0b248b69e965/
SH256 hash:
6d0429bb3533ea8cd3b10d207ec5505ac0d38692f7f4cd1375db7cd1aba0be6e
MD5 hash:
3c4423af11c238b361c08011535d9533
SHA1 hash:
b26d85c039149f3cdb534332d9054bf8b193475b
Link:
https://www.unpac.me/results/97c97c52-98ee-4af9-a554-0b248b69e965/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6d0429bb3533/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d0429bb3533ea8cd3b10d207ec5505ac0d38692f7f4cd1375db7cd1aba0be6e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/312755/

Comments