MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9
SHA3-384 hash: 7e819e66f1f5aef06eff04413aa191dbf01c9f0f25fbc826ce77c9ec64b2126c47ddca1a7a1875381bb0ed4a97129cca
SHA1 hash: fdafa1744005ba5766c230a44a53b570db5a9de4
MD5 hash: 85d9770f45c0a07aff776b5117e8fc71
humanhash: failed-twelve-asparagus-golf
File name:85d9770f45c0a07aff776b5117e8fc71.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:980'480 bytes
First seen:2020-07-19 09:52:38 UTC
Last seen:2020-07-19 11:11:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5bcd1e2123c48e21d9f6becf87aa7d92 (1 x RedLineStealer)
ssdeep 24576:R7PEVhRTPg3Wk0mRU0Y6oWdTNQr5MORZIjWuW:R7gR7gmk030zZdTWmOPICuW
TLSH C62523217541C873EA9661794D4DC2B08D7E7DBCAA32638337D847AD1F312E2DB09A86
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://45.67.229.57:81/IRemotePanel

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27782/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Connection attempt to an infection source
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/389709
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247028 Sample: iiHnQ6KFGh.exe Startdate: 19/07/2020 Architecture: WINDOWS Score: 80 27 Multi AV Scanner detection for submitted file 2->27 29 Yara detected RedLine Stealer 2->29 31 Yara detected MSIL Crypter 2->31 33 2 other signatures 2->33 8 iiHnQ6KFGh.exe 1 2->8         started        process3 file4 23 C:\Users\user\AppData\...\iiHnQ6KFGh.exe.log, ASCII 8->23 dropped 35 Detected unpacking (overwrites its own PE header) 8->35 12 RegAsm.exe 15 2 8->12         started        signatures5 process6 dnsIp7 25 45.67.229.57, 81 ALEXHOSTMD Moldova Republic of 12->25 15 cmd.exe 1 12->15         started        process8 process9 17 taskkill.exe 1 15->17         started        19 conhost.exe 15->19         started        21 choice.exe 1 15->21         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-07-18 20:36:23 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oeu2euwnaowix2xqlzdykyseiiwskhm4dy3ttevlvl7idgnu774q._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/200719-rns3zzsax2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of SetThreadContext
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 7129a252cd03ac8beaf05e47856244422d251d9c1e373992abaafe8199b4fff9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/408894/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/27782/

Comments