🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2
SHA3-384 hash: fea6bacc216300b7dd4bedf79373755af1f2e2f5824b63a47b52adbbfa34adb8678dde060a844d7d35aa1724b41adbf3
SHA1 hash: d608338ee741b1be87b008695fe9b454ec21e50e
MD5 hash: 8aa46a6f36b43fe3acfc0760043e422b
humanhash: skylark-winner-cup-ink
File name:8aa46a6f36b43fe3acfc0760043e422b
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:911'584 bytes
First seen:2022-01-29 13:00:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 35cc099d781c65d0534d2c27f2d3d3cc (1 x RedLineStealer)
ssdeep 24576:g410y5atBweUG9d6fBKCYuLb6A6OTtwu:2oiUrBTYO+A6Op
Threatray 31 similar samples on MalwareBazaar
TLSH T1E91512E3F704ADEBC41A26B65402C8713872DC66A57A796AB0CDFA2B1D713436587F03
File icon (PE):PE icon
dhash icon d0d0f8dcf498dcdc (2 x RedLineStealer, 1 x PrivateLoader)
Reporter zbetcheckin
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8aa46a6f36b43fe3acfc0760043e422b
Verdict:
Malicious activity
Analysis date:
2022-01-29 13:06:18 UTC
Tags:
trojan rat redline loader
Link:
https://app.any.run/tasks/223920d3-d8ca-4ca5-b5ab-697ce43aa5bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/225783/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.32121.11165.27591.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
Launching a process
Sending a TCP request to an infection source
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f53a6906e7677a191349df/reports/9dec5300-e487-4e4e-826b-7690e1aa0857/overview
Malware family:
Hive
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4587792a-a435-496f-a37d-f74054213d50
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/930134
Signature
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected VMProtect packer
Drops PE files with benign system names
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: File Created with System Process Name
Sigma detected: System File Execution Location Anomaly
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 562612 Sample: 9JVbkBLPgw Startdate: 29/01/2022 Architecture: WINDOWS Score: 100 83 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Multi AV Scanner detection for submitted file 2->87 89 7 other signatures 2->89 10 9JVbkBLPgw.exe 15 8 2->10         started        15 cmd.exe 2->15         started        process3 dnsIp4 75 85.202.169.245, 49816, 49819, 80 GUDAEV-ASRU Netherlands 10->75 77 91.243.32.101, 1568, 49773 MATTEOGB Russian Federation 10->77 63 C:\Users\user\AppData\Local\Temp\build1.exe, PE32+ 10->63 dropped 65 C:\Users\user\AppData\Local\Temp\build.exe, PE32+ 10->65 dropped 67 C:\Users\user\AppData\...\9JVbkBLPgw.exe.log, ASCII 10->67 dropped 111 Detected unpacking (changes PE section rights) 10->111 113 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->113 115 Tries to detect sandboxes and other dynamic analysis tools (window names) 10->115 119 5 other signatures 10->119 17 build1.exe 4 10->17         started        21 build.exe 1 10->21         started        117 Encrypted powershell cmdline option found 15->117 24 conhost.exe 15->24         started        26 powershell.exe 15->26         started        28 powershell.exe 15->28         started        file5 signatures6 process7 dnsIp8 61 C:\Users\user\AppData\...\services.exe, PE32+ 17->61 dropped 91 Antivirus detection for dropped file 17->91 93 Multi AV Scanner detection for dropped file 17->93 95 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->95 99 3 other signatures 17->99 30 cmd.exe 17->30         started        32 cmd.exe 1 17->32         started        35 cmd.exe 17->35         started        69 accounts.google.com 142.250.203.109, 443, 49821 GOOGLEUS United States 21->69 71 youtube-ui.l.google.com 172.217.168.46, 443, 49820 GOOGLEUS United States 21->71 73 www.youtube.com 21->73 97 Tries to harvest and steal browser information (history, passwords, etc) 21->97 file9 signatures10 process11 signatures12 37 services.exe 30->37         started        40 conhost.exe 30->40         started        79 Encrypted powershell cmdline option found 32->79 81 Uses schtasks.exe or at.exe to add and modify task schedules 32->81 42 powershell.exe 24 32->42         started        44 conhost.exe 32->44         started        46 powershell.exe 32->46         started        48 conhost.exe 35->48         started        50 schtasks.exe 35->50         started        process13 signatures14 103 Antivirus detection for dropped file 37->103 105 Multi AV Scanner detection for dropped file 37->105 107 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 37->107 109 2 other signatures 37->109 52 cmd.exe 37->52         started        process15 signatures16 101 Encrypted powershell cmdline option found 52->101 55 conhost.exe 52->55         started        57 powershell.exe 52->57         started        59 powershell.exe 52->59         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-01-25 02:56:00 UTC
File Type:
PE (Exe)
Extracted files:
89
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oy4u6tr6ynetaub6nbul5637uji3cvifo7ge22db77oghc6rvsza._file
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Similar samples:
02b9159f39f4912af2fa68281a500161302f34cd00ce7dfd22861728e55f8956
RedLineStealer
1d954347b4549a195aebc8a176ea7f1140c902bd3f8fddaba2099d8a6f86a216
RedLineStealer
1e061432a06c9e4935cd837118e5d68d79ec6c6bbdddcc40d8682e50db7344fa
RedLineStealer
5aeeb53a492389bfaaa1a2d15b98324c159ded6cd2e55dd67efb3eba6e4ee270
RedLineStealer
67e030c1c7dd08138eb1d6a12a4d652c4a304f22db556afce411c32a23bddf23
RedLineStealer
973549247e54570bae7013e0346274e5afefef1d7bf2dae489c7c32e210df67c
RedLineStealer
bfbb5f477e58c173f83ab157415782b680694c9ba43d20bef89dda58bc840c06
RedLineStealer
e709230351716712a3fc0683afa91a4855f79a07582d317ff8b449278150d4b2
RedLineStealer
+ 21 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer vmprotect
Link:
https://tria.ge/reports/220129-p8sxlsbacn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
RedLine
RedLine Payload
Unpacked files
SH256 hash:
a17d2b1c2554fa2a46c2bf68570c48cf7d39b80922caa8d233cd4341cb5e0f87
MD5 hash:
36c31ab0da0b9db32f79d9b960afb4be
SHA1 hash:
23c4d4268642c554874dec17302aefbbb7291a7a
Link:
https://www.unpac.me/results/97145e4d-ebe0-49c3-a95e-13b2499441ea/
SH256 hash:
76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2
MD5 hash:
8aa46a6f36b43fe3acfc0760043e422b
SHA1 hash:
d608338ee741b1be87b008695fe9b454ec21e50e
Link:
https://www.unpac.me/results/97145e4d-ebe0-49c3-a95e-13b2499441ea/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/76394f4e3ec3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/225783/
  
URLhaus
https://urlhaus.abuse.ch/url/2013853/

Comments


Avatar
zbet commented on 2022-01-29 13:00:20 UTC

url : hxxp://coin-coin-file-9.com/files/2711_1642960902_5313.exe