MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2322e744d3a13cb9c069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2322e744d3a13cb9c069
SHA3-384 hash: 241e94b54bdfa57c8be968dcb11dc72dc97ad1a318bbf3c5cbd0a313de12e104a8617640c665bdee99ab00829a95b707
SHA1 hash: d85d900a8a7320e0a0842955ef9f0bdeff524d25
MD5 hash: 3f20ed6d9f1874f5c4dd51b912e4571d
humanhash: eleven-nine-mars-yellow
File name:70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'109'504 bytes
First seen:2023-08-13 11:45:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fadc5a257419d2541a6b13dfb5e311e2 (14 x XWorm, 5 x StormKitty, 3 x CoinMiner)
ssdeep 24576:LrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvapNkyJ2u:L2EYTb8atv1orq+pEiSDTj1VyvBapNDw
Threatray 95 similar samples on MalwareBazaar
TLSH T142357D0973A441ADFEABE176CA23C607D7B178460277862F01A49B767F337715A2E321
TrID 90.1% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.8% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
0.9% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
94.142.138.167:19615

Intelligence

File Origin
# of uploads :
1
# of downloads :
385
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2.exe
Verdict:
Malicious activity
Analysis date:
2023-08-13 11:46:54 UTC
Tags:
evasion loader redline
Link:
https://app.any.run/tasks/3b06d3d8-1c1d-462d-8762-a239b083977f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/442503/
Detection(s):
SecuriteInfo.com.Win64.Malware-gen.20515.25502.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/102775/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckNumberOfProcessor
CheckCmdLine
EvasionQueryPerformanceCounter
Gathering data
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2322e744d3a13cb9c069
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/926f5257-07de-429d-ad9c-a06cdd7ec1b1
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1290660
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to modify clipboard data
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses ping.exe to check the status of other devices and networks
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1290660 Sample: 70efbdb447fb1205e4a9fd9ce59... Startdate: 13/08/2023 Architecture: WINDOWS Score: 100 58 Snort IDS alert for network traffic 2->58 60 Multi AV Scanner detection for domain / URL 2->60 62 Found malware configuration 2->62 64 12 other signatures 2->64 7 70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2.exe 22 2->7         started        process3 dnsIp4 44 m10b18tu.info 77.246.100.5, 49705, 49738, 49739 MEDIAL-ASRU Russian Federation 7->44 46 iplogger.com 148.251.234.93, 443, 49706 HETZNER-ASDE Germany 7->46 48 seriopoli.info 7->48 32 C:\Users\user\AppData\...\sweatbegas.exe, PE32 7->32 dropped 34 C:\Users\user\AppData\Local\...\swatbig.exe, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\...\swatbegas.exe, PE32 7->36 dropped 38 5 other malicious files 7->38 dropped 72 May check the online IP address of the machine 7->72 74 Binary is likely a compiled AutoIt script file 7->74 76 Self deletion via cmd or bat file 7->76 78 Contains functionality to modify clipboard data 7->78 12 swatbig.exe 14 3 7->12         started        16 1161156982.exe 15 5 7->16         started        18 swatbegas.exe 1 7->18         started        20 2 other processes 7->20 file5 signatures6 process7 dnsIp8 50 n57b30a.info 12->50 52 api.ip.sb 12->52 80 Antivirus detection for dropped file 12->80 82 Detected unpacking (changes PE section rights) 12->82 84 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->84 96 5 other signatures 12->96 54 b47n300.info 77.105.136.3, 49716, 49736, 80 PLUSTELECOM-ASRU Russian Federation 16->54 56 api.ip.sb 16->56 86 Machine Learning detection for dropped file 16->86 88 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->88 90 Tries to evade debugger and weak emulator (self modifying code) 16->90 92 Multi AV Scanner detection for dropped file 18->92 22 csc.exe 18->22         started        94 Uses ping.exe to check the status of other devices and networks 20->94 26 AppLaunch.exe 20->26         started        28 conhost.exe 20->28         started        30 PING.EXE 20->30         started        signatures9 process10 dnsIp11 40 94.142.138.167, 19615, 49748 IHOR-ASRU Russian Federation 22->40 66 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 22->66 68 Tries to harvest and steal browser information (history, passwords, etc) 22->68 42 109.94.208.20, 49740, 5972 RETN-ASEU Russian Federation 26->42 70 Tries to harvest and steal ftp login credentials 26->70 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2322e744d3a13cb9c069/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-08-13 11:46:07 UTC
File Type:
PE+ (Exe)
Extracted files:
22
AV detection:
14 of 24 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=odx33nch7mjalzfj7woolhj46mnl2q7kmdvsgixhitj2cpfzybuq._file
Verdict:
malicious
Similar samples:
24a93ddf60120497dd5848ec03147621840eb5b371d81a999e8af55f959466db
RedLineStealer
4e55c10e79e88019cc44951789afefd670fadaa18570a9ad3bfac0a495b7278f
RedLineStealer
5377fdf4a8c5b2de8f21a23a0770fbc497d3ba1ff58d50d1ec952216e84a3c4f
RedLineStealer
5968ecd998efdc29c38505e7640c1b2af832e1679a957523f89cbd890984c642
RedLineStealer
6b109e55911293b4e5098d3711849b85499a988385721863a01c2e0dcd9ba0a6
RedLineStealer
82e3523dc7d162e55eaa4f69c2dba9555592661eadcc6807898da7196e57289a
RedLineStealer
88ab1357fe12b53be4b4f143d3b82d6b0f8a5fe08d23a0c53f2f588f7d181d41
RedLineStealer
97ff84a22b9ae106c9c6d6893575360411773f084d600ae3ae21bec7b26a4c66
RedLineStealer
bc261f0ce50b7e511ceb575a556d7ed74655b406f264b997c237558d2f771698
RedLineStealer
ce87832b753df5480849c61df4e05bfd2bfbd72af88ad52093a54555f3d96f0e
RedLineStealer
+ 85 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware stealer
Link:
https://tria.ge/reports/230813-nxaq8adf2z/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Deletes itself
Executes dropped EXE
Reads user/profile data of web browsers
Downloads MZ/PE file
RedLine
RedLine payload
Malware Config
C2 Extraction:
94.142.138.167:19615
Unpacked files
SH256 hash:
70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2322e744d3a13cb9c069
MD5 hash:
3f20ed6d9f1874f5c4dd51b912e4571d
SHA1 hash:
d85d900a8a7320e0a0842955ef9f0bdeff524d25
Link:
https://www.unpac.me/results/6df2a56e-a57c-42d4-98e5-687318c3aa4a/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/70efbdb447fb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70efbdb447fb1205e4a9fd9ce59d3cf31abd43ea60eb2322e744d3a13cb9c069

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/442503/

Comments