MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64
SHA3-384 hash: 449f357378c9136cc747cfa90acb14f68c49c366fd71fdfa2ff4803c3ec63d39dd163c91887f9526b4a10ba5ac13f6e3
SHA1 hash: 23db90c824e77ea619c3f771c75d919c703e9735
MD5 hash: 4d970a2e52b9b8211c64097581942527
humanhash: quebec-early-salami-wyoming
File name:76CDE08B521A97BAF4AEBAB068D5C41FA03821DC4C417.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'157'522 bytes
First seen:2021-08-16 14:36:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a1a66d588dcf1394354ebf6ec400c223 (49 x RedLineStealer, 7 x CryptBot, 4 x AZORult)
ssdeep 24576:SdW6C292GDnK/p61BLUEuG7W7Mmw87WVQ9Yaek4QpWMLMG:SdW6CLcK/w1Zr7uLpWa9Yq9gk
Threatray 115 similar samples on MalwareBazaar
TLSH T1FF35F033E6CA5279D299043039B4EF34C0B57E110715868762DCAE3B7AF738DD6A628D
dhash icon c8f3b6c6fe7a7260 (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
94.242.224.231:22141

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
94.242.224.231:22141 https://threatfox.abuse.ch/ioc/190259/

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
76CDE08B521A97BAF4AEBAB068D5C41FA03821DC4C417.exe
Verdict:
Malicious activity
Analysis date:
2021-08-16 14:38:12 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/428ede9d-8403-42ca-a07b-e74bd2701aac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179563/
Detection(s):
Win.Trojan.Generic-9874371-0
Create hunting rule

SecuriteInfo.com.Adware.Softobase.12.1822.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Creating a process from a recently created file
Deleting a recently created file
DNS request
Sending a UDP request
Connection attempt
Sending an HTTP POST request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file
Reading critical registry keys
Searching for the window
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d62809bd-3def-4571-bae3-9ffd2dd9b94a
Result
Threat name:
Ficker Stealer RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/833587
Signature
Contains functionality to register a low level keyboard hook
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Ficker Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 466018 Sample: 76CDE08B521A97BAF4AEBAB068D... Startdate: 16/08/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for submitted file 2->54 56 Yara detected Ficker Stealer 2->56 58 Yara detected RedLine Stealer 2->58 60 2 other signatures 2->60 10 76CDE08B521A97BAF4AEBAB068D5C41FA03821DC4C417.exe 7 2->10         started        process3 signatures4 70 Contains functionality to register a low level keyboard hook 10->70 13 cmd.exe 1 10->13         started        process5 signatures6 72 Submitted sample is a known malware sample 13->72 74 Obfuscated command line found 13->74 76 Uses ping.exe to sleep 13->76 78 Uses ping.exe to check the status of other devices and networks 13->78 16 cmd.exe 3 13->16         started        19 conhost.exe 13->19         started        process7 signatures8 50 Obfuscated command line found 16->50 52 Uses ping.exe to sleep 16->52 21 Piacerebbe.exe.com 16->21         started        23 PING.EXE 1 16->23         started        26 findstr.exe 1 16->26         started        process9 dnsIp10 29 Piacerebbe.exe.com 1 21->29         started        46 127.0.0.1 unknown unknown 23->46 38 C:\Users\user\AppData\...\Piacerebbe.exe.com, Targa 26->38 dropped file11 process12 dnsIp13 48 WaNvvRytuWaZQF.WaNvvRytuWaZQF 29->48 40 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 29->40 dropped 80 Writes to foreign memory regions 29->80 82 Injects a PE file into a foreign processes 29->82 34 RegAsm.exe 15 29 29->34         started        file14 signatures15 process16 dnsIp17 42 api.ip.sb 34->42 44 94.242.224.231, 22141, 49732, 49741 ROOTLU Luxembourg 34->44 62 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 34->62 64 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 34->64 66 Tries to harvest and steal browser information (history, passwords, etc) 34->66 68 Tries to steal Crypto Currency Wallets 34->68 signatures18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64/
Threat name:
Win32.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2021-06-04 11:20:38 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o3g6bc2sdkl3v5foxkygrvoed6qdqio4jraxbj4r5o64w2rg3zsa._file
Verdict:
unknown
Similar samples:
0868a2a7b5e276d3a4a40cdef994de934d33d62a689d7207a31fd57d012ef948
RedLineStealer
3f3ce1f91c8f439a2c903fa08544b08e21704a53c3ab260d3a0b8d3dea425020
RedLineStealer
41f2e8b68fe406f818f0ab48067d967cc0a3430a9ddb97a191b3fca163b756ab
RedLineStealer
830c5c98b459bc47ddb319f2262cb248fb9999a6115182b199bb4421f0897051
RedLineStealer
8d16d53c256f90f392a7fe4f55ebdaac30cfd984155be174c1850adc7dadecff
RedLineStealer
90a286ac5b49100aeb8038af277dbabc3853e6fe5557c19d5a64885f015596b1
RedLineStealer
ba15de0f65e1d9b9d7ed54603aed434676f2f0c8eb759fd20c9cf44693abf786
RedLineStealer
d561dfe74cc927428dad121c5a8d60f0289a43382e6130bc72a6b34c000b9b9b
RedLineStealer
ff550d834cbad023b595e724c47cb9fe47ba66af9a22992a9ea89a686fcbb66a
RedLineStealer
+ 105 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:kakaakakakak discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210816-7xs75gv73e/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
94.242.224.231:22141
Unpacked files
SH256 hash:
295810704740e81fed149741977fec0c91b2bb13cf7de12f5c208dcbedb1dbda
MD5 hash:
8390c18c9781855d5b60bfadd23d3e9b
SHA1 hash:
9e6096c0674d6d42271cca86492180829cb4a67e
Link:
https://www.unpac.me/results/b3eed8d6-bbe9-46fd-b235-89b2c94be7d5/
SH256 hash:
d99145ab93f2f32ed3a553992213cdd23f9cd869e74665e449f55b7b4a461c8f
MD5 hash:
cb4e827ff80fc7cc0ad57315f808df3a
SHA1 hash:
f86a836c9fc6a7b1f4273cb575c5244d955b0fb3
Link:
https://www.unpac.me/results/b3eed8d6-bbe9-46fd-b235-89b2c94be7d5/
Parent samples :
ec975154fabacbe2d626ab551470dec7500cfcc32507270ef1d0039c44e47d6d
d477322f8d90be3d37d78ab73d97d59e0ae6ca7ac32e2fdefd5668f67cb1fb62
bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7
39f3698e7359c0a93122897138c050ecb0b71d71843f68ba8d05a9ed7e7cb67b
d159901426c9d9c00934d53977abff7932b37f69febdb6cab2a80333e79c3f1a
774368536ee17949132b38f6067b9b6aea5362c1f23fb06410b4e8cec4c2ed5c
bb653dddd858f686a07ac236a6098d9da8dcb8524aedc8da2cb5a6f084cbfebc
edc325712bb62fcd4fe96f6bf63559449b9158b816768a8122dad070e8aaf44e
06e81f5bb3b70ddd48d4711afd1f75776bc1e28e787ffd5dab9459083796f437
59a0f409289061eed9d13f294a5d63cf1f72dafb7302272b935aba711a0d1870
9fa64c90a5f724bb282934ee693fac3b8f82a7a08039d52946904262f8d2ec6a
645ee0535f2ada91b101c0029f2fb71de2a27c10a5446e84d3547968ea36eafe
6d50bd480bb0c65931eb297b28c4af74b966504241fca8cd03de7058a824274d
SH256 hash:
76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64
MD5 hash:
4d970a2e52b9b8211c64097581942527
SHA1 hash:
23db90c824e77ea619c3f771c75d919c703e9735
Link:
https://www.unpac.me/results/b3eed8d6-bbe9-46fd-b235-89b2c94be7d5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/76cde08b521a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76cde08b521a97baf4aebab068d5c41fa03821dc4c4170a791ebbdcb6a26de64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179563/

Comments