MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 752abe1050403b95676de500b60db8b36e26f02e4b24eb84ae9f4daf6d03b957. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 752abe1050403b95676de500b60db8b36e26f02e4b24eb84ae9f4daf6d03b957
SHA3-384 hash: 9c4ee946c58d710d5b6d416a3dc4a7451b1975101391ab93a31a8b51fb16d950d8597e26d784bac8fe79884d419bfbe5
SHA1 hash: 305eba6b746ff40758172f35308a5174067976f1
MD5 hash: 937b3a38de78efb77eb6d8fb4c741051
humanhash: freddie-hotel-music-georgia
File name:937b3a38de78efb77eb6d8fb4c741051.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'606'824 bytes
First seen:2021-03-22 09:12:13 UTC
Last seen:2021-03-22 10:45:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2fb819a19fe4dee5c03e8c6a79342f79 (56 x Adware.InstallCore, 8 x RedLineStealer, 7 x Adware.ExtenBro)
ssdeep 98304:ZX6Zrjl6Q0hFPuXKkHgkxgKTPn8KvoKGqLGlN0duHG+kl0/mfp:x6ZrjeF2Fgq88sIvduHG+kK/mfp
Threatray 132 similar samples on MalwareBazaar
TLSH A4263362DE62D530C3D386F2BF239267DD6FF62140B87509ABC558BF2949C31E6A0B11
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://217.12.209.160:33333/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://217.12.209.160:33333/ https://threatfox.abuse.ch/ioc/4359/

Intelligence

File Origin
# of uploads :
2
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
937b3a38de78efb77eb6d8fb4c741051.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-22 09:16:33 UTC
Tags:
installer
Link:
https://app.any.run/tasks/0098d333-8759-478c-a188-59039a5e6232

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/125867/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.62935.3625.15598.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/647550
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Drops PE files to the startup folder
Drops PE files with benign system names
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Sigma detected: Check external IP via Powershell
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 372739 Sample: mj8ejPVt3a.exe Startdate: 22/03/2021 Architecture: WINDOWS Score: 84 65 po.ottezav.ru 2->65 67 liverpoolsupporters9.com 2->67 69 iplogger.org 2->69 87 Found malware configuration 2->87 89 Antivirus detection for URL or domain 2->89 91 Antivirus detection for dropped file 2->91 93 14 other signatures 2->93 10 mj8ejPVt3a.exe 2 2->10         started        13 svchost.exe 2->13         started        16 svchost.exe 9 1 2->16         started        19 5 other processes 2->19 signatures3 process4 dnsIp5 61 C:\Users\user\AppData\...\mj8ejPVt3a.tmp, PE32 10->61 dropped 21 mj8ejPVt3a.tmp 30 22 10->21         started        105 Changes security center settings (notifications, updates, antivirus, firewall) 13->105 63 127.0.0.1 unknown unknown 16->63 file6 signatures7 process8 file9 47 C:\Program Files (x86)\...\is-RJ833.tmp, PE32 21->47 dropped 49 C:\Program Files (x86)\...\is-OJFUJ.tmp, PE32 21->49 dropped 51 C:\Program Files (x86)\...\is-KBEAS.tmp, PE32 21->51 dropped 53 5 other files (3 malicious) 21->53 dropped 24 work.exe 21->24         started        29 Rochet.exe 21->29         started        31 AsyncClient.exe 21->31         started        33 9 other processes 21->33 process10 dnsIp11 75 iplogger.org 24->75 55 C:\Users\user\AppData\...\Chrome updater.exe, PE32 24->55 dropped 95 Query firmware table information (likely to detect VMs) 24->95 97 Hides threads from debuggers 24->97 99 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->99 101 Sample uses process hollowing technique 29->101 103 Injects a PE file into a foreign processes 29->103 77 liverpoolsupporters9.com 172.67.176.78, 49736, 50035, 50143 CLOUDFLARENETUS United States 31->77 57 C:\Users\user\...\IWglkglPxdJdVIbeLE.exe, PE32 31->57 dropped 59 C:\Users\Public\Documents\...\svchost.exe, PE32 31->59 dropped 79 api.ip.sb 33->79 81 8dyv.alemention.ru 81.177.140.11, 443, 49719, 49720 RTCOMM-ASRU Russian Federation 33->81 83 4 other IPs or domains 33->83 35 iexplore.exe 33->35         started        38 certreq.exe 33->38         started        40 certreq.exe 33->40         started        42 7 other processes 33->42 file12 signatures13 process14 dnsIp15 44 iexplore.exe 35->44         started        71 iplogger.org 88.99.66.31, 443, 49714, 49715 HETZNER-ASDE Germany 38->71 73 192.168.2.1 unknown unknown 40->73 process16 dnsIp17 85 iplogger.org 44->85
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/752abe1050403b95676de500b60db8b36e26f02e4b24eb84ae9f4daf6d03b957/
Threat name:
Win32.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-03-20 21:48:00 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ouvl4ecqia5zkz3n4ualmdnywnxcn4bojmsoxbfot5g263idxflq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
4046dccfa2b2852d5e1330d6dcbdd1f82a484d91b629c75c50adb5d0195a90f5
RedLineStealer
621c08e8f0b10550a1a20f440f0c9f14d6d108a6df9968a78146140faa88f426
RedLineStealer
6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787
RedLineStealer
7a9db6042869b4a1f8e6a9d147c2abc763ba2ff35821ac572949307bb9857c18
RedLineStealer
8c38ea1b07ac6af7083834889e6c999fd84c857a767cf0928be1e7812a594849
RedLineStealer
d1597e584fec8eb356aa5c831045b2ce68531e69fe70436fa3ca0d8dd1d90ca7
RedLineStealer
dea2e88e71d3b38500aca694a9ba1f476d8db14e5389a2cf70b23cad51eb33c9
RedLineStealer
e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37
RedLineStealer
efb5ee93cfb2bdcf1a0391c00d3a8fbd23ffe6862fa302bef3a839e8f39453fa
RedLineStealer
fd32e6bad3561c5fe9dcb7cc9429fb110fea37c843753f33f453b18df751520e
RedLineStealer
+ 122 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210322-py91rek27x/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
3a4b61d339b4df8ad7c91ccb1e1a3e5a3dcf11de4aa902d67241426fffe98d41
MD5 hash:
4291b1ab852323770a0612678b033c2f
SHA1 hash:
73df81a1ccb31d0d3aab3b03182e36b91f3866df
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
68ef35c8fc6404c6a63226c0e451b5c45068527a02e03e8a1428b9ae89ccdb4e
MD5 hash:
bb40fa56d6d5175a81c91c9bd3941d80
SHA1 hash:
09863d971602fd7c4171696d7a3e64dad8ef26a6
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
09f0d4cdba60b19fd27032617093ffb0fabd6c7de8e3446345623f96706ca87c
MD5 hash:
c296ab676408ed25c0acd2026b664141
SHA1 hash:
dfe09b370eb7c2ba0c03c3dc451ca779c331c26c
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
6d985efac2b7f469a0b4b0e861b655639a3aa4d3c606eff5f7de8e8b67b4e270
MD5 hash:
165ea34bd74f45a6931de83b86ed5e51
SHA1 hash:
ce1cceba9e50519d9999b14bc16945d6130a3170
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
1510861928b533e1529c1ffe7c6d57d9e5e928830d0afb28fd0fa730ff83fbdc
MD5 hash:
8f85df46a482b5b068ae7667bf1a33d6
SHA1 hash:
a210d369311aa4d709dc962c634174738576907e
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
5ba8441fe52b059e6b7db5cba6a8d2e1e132b7e7fc97ceeb0c741fa5f8e90331
MD5 hash:
e75ad534ae98c2de24e752421bd2548b
SHA1 hash:
88970520cc4c813e0280c5ebcd0bd0878e87933e
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
ac888acc8c36e819bcd2b3e34a9634296a94bed5dfe41b4ae417e74d29a91633
MD5 hash:
d682d159fda5a244055e1bf63f954f27
SHA1 hash:
e0f3472352ba6c00e2741db166c57c4dd0d4b723
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
f838cad5face01dedebc18fa2a72ef4d0c13db453c9027acb61c5f8b8a4a0501
MD5 hash:
e026527cb466dba7c400548d29b5ba51
SHA1 hash:
c46c83b966b5d48f022f40cde87bada73f8931b0
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
39327097de2c11f875dc7f258f82405c520c3f766e819baa678274c6a937ee3d
MD5 hash:
c696895f8e0ba874002c89a33898775b
SHA1 hash:
9a893fbe5be052ce963b3675b7153d93cfc435b1
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
a8d1bf5dcfd82536cb2d9900e5b64881c6b46ab2ba0778f63f5bf9f934352359
MD5 hash:
30347b3a56045e0a7bee9da4ac0e3c3d
SHA1 hash:
55d629517832bfd9aaf81bfa09ce47a2c743e403
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
436226a3298c5ad48f97529ff5011e19453575e9a31565c821d1a1268628210b
MD5 hash:
d63767bf5085fda47d3c801561c90570
SHA1 hash:
8288e7520a5731892ccc970b1d0761e6d85fb396
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
SH256 hash:
752abe1050403b95676de500b60db8b36e26f02e4b24eb84ae9f4daf6d03b957
MD5 hash:
937b3a38de78efb77eb6d8fb4c741051
SHA1 hash:
305eba6b746ff40758172f35308a5174067976f1
Link:
https://www.unpac.me/results/dd1bee96-659a-4cec-8aa3-c33cbd46c680/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/752abe1050403b95676de500b60db8b36e26f02e4b24eb84ae9f4daf6d03b957

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/125867/

Comments