MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7817a0794693ad5eaffdc86ca9d8cf7350f9159433d376840e9f6cb6b9c60edc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 10
| SHA256 hash: | 7817a0794693ad5eaffdc86ca9d8cf7350f9159433d376840e9f6cb6b9c60edc |
|---|---|
| SHA3-384 hash: | 8e4b23eabfa874d6c0589775c5cb81c0c334268c0d149da4fcda21f10bcf61ab022c911c3f009cccf19d39a233b20696 |
| SHA1 hash: | 38f7a8f48e69cd76424094a95adb9d3d20f34a7a |
| MD5 hash: | 2caee7499ed70d48c8c8d73470249d67 |
| humanhash: | mockingbird-eight-edward-undress |
| File name: | 2CAEE7499ED70D48C8C8D73470249D67.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 8'280'766 bytes |
| First seen: | 2021-04-26 19:16:49 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a1a66d588dcf1394354ebf6ec400c223 (49 x RedLineStealer, 7 x CryptBot, 4 x AZORult) |
| ssdeep | 196608:Y5aFumXV/+lmefLXegGU9uptpNuFHF/ZPholNZq:Y5aMQV2HfhG6uptXyF/ZPh+u |
| Threatray | 276 similar samples on MalwareBazaar |
| TLSH | D08633116FAD80BCE9B42A301D71D242EC70EE195B7492B78E467B1DCC746E1AE2D3C9 |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 104.21.13.248:80 | https://threatfox.abuse.ch/ioc/10240/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Sending a UDP request
Launching a process
Creating a process from a recently created file
Deleting a recently created file
DNS request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Binary is likely a compiled AutoIt script file
Contains functionality to register a low level keyboard hook
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Detection:
redlinestealer
Threat name:
Win32.Trojan.Crypzip
Status:
Malicious
First seen:
2021-04-25 00:39:00 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 266 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline botnet:eumix4 evasion infostealer persistence spyware stealer
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies system certificate store
Runs net.exe
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Modifies WinLogon
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Modifies RDP port number used by Windows
Modifies Windows Firewall
Sets DLL path for service in the registry
Grants admin privileges
RedLine
RedLine Payload
Malware Config
C2 Extraction:
crownnest.cyou:80
Unpacked files
SH256 hash:
6d787adbb63a96caba316fa1ac885a63e21cd1cac06acf050f061fbeaeda0aaf
MD5 hash:
21462e50be9187aff0a417277a32f77f
SHA1 hash:
96347add332eff738a331432f28814b37cee9859
SH256 hash:
3db6a6bfd8df2b6caf66056dbbd71d62e6068efcbd14e587435ca874bdea08d8
MD5 hash:
06162e245fe9e0a15b6fa90505f25523
SHA1 hash:
dda949895e79e438d37fff523ce4ee04b1328a72
SH256 hash:
7817a0794693ad5eaffdc86ca9d8cf7350f9159433d376840e9f6cb6b9c60edc
MD5 hash:
2caee7499ed70d48c8c8d73470249d67
SHA1 hash:
38f7a8f48e69cd76424094a95adb9d3d20f34a7a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AutoIT_Compiled |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies compiled AutoIT script (as EXE). |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekshen |
| Description: | Detects RedLine infostealer |
| Rule name: | Select_from_enumeration |
|---|---|
| Author: | James_inthe_box |
| Description: | IP and port combo |
| Rule name: | Steam_stealer_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Steam in files like avemaria |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [F0002.001] Collection::Application Hook
1) [F0002.002] Collection::Polling
2) [C0029.003] Cryptography Micro-objective::SHA256::Cryptographic Hash
3) [C0032.001] Data Micro-objective::CRC32::Checksum
4) [C0026.002] Data Micro-objective::XOR::Encode Data
6) [C0046] File System Micro-objective::Create Directory
7) [C0048] File System Micro-objective::Delete Directory
8) [C0047] File System Micro-objective::Delete File
9) [C0049] File System Micro-objective::Get File Attributes
10) [C0051] File System Micro-objective::Read File
11) [C0050] File System Micro-objective::Set File Attributes
12) [C0052] File System Micro-objective::Writes File
13) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
14) [C0017] Process Micro-objective::Create Process
15) [C0038] Process Micro-objective::Create Thread
16) [C0054] Process Micro-objective::Resume Thread
17) [C0018] Process Micro-objective::Terminate Process