MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c790dc9174daf4135dcfdc30aad3ba8df18fc1cf4ce549c51501fa7eb7be38d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c790dc9174daf4135dcfdc30aad3ba8df18fc1cf4ce549c51501fa7eb7be38d
SHA3-384 hash: 841392f06f9f4debef575e4058c8cde396de8795f56e692730ed1a2a2ff82fa106d724289149672d4db9bec32adbd125
SHA1 hash: 4dc9554e75fa372a7ffc963f0bc25308213d19e7
MD5 hash: 9a7146fc6a650f4e344aa8102c5986e2
humanhash: lake-twenty-stream-five
File name:9a7146fc6a650f4e344aa8102c5986e2
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:192'416 bytes
First seen:2021-10-28 00:07:34 UTC
Last seen:2021-10-28 01:10:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:KGfHI7+9KN8/qoQ1eUzFHiHAcw4yNxahqjMCBpD9CHJtjLSTJTAPK65zjs5S+:Xt908/qheU5HiPw4yNxaUjlxKJtjOVTr
Threatray 2'030 similar samples on MalwareBazaar
TLSH T183148F137F08F718D0943E7382DF5E1607AA2EC28A73AED72E4D9E5016526422E7736D
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200726/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.29417.8988.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Forced shutdown of a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated overlay packed packed redline
Link:
https://www.filescan.io/uploads/6179e9e49a5a1e91c5d87046/reports/0b69fa34-f953-4d2c-a988-ed3c2a30e314/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/716ee384-ce58-4396-94b3-a1857c5c4300
Result
Threat name:
BitCoin Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878191
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Detected VMProtect packer
Drops PE files to the user root directory
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510625 Sample: j1XcBWNHwh Startdate: 28/10/2021 Architecture: WINDOWS Score: 100 90 Found malware configuration 2->90 92 Multi AV Scanner detection for submitted file 2->92 94 Yara detected BitCoin Miner 2->94 96 5 other signatures 2->96 13 j1XcBWNHwh.exe 3 2->13         started        process3 file4 76 C:\Users\user\AppData\...\j1XcBWNHwh.exe.log, ASCII 13->76 dropped 138 Writes to foreign memory regions 13->138 140 Injects a PE file into a foreign processes 13->140 17 RegAsm.exe 15 7 13->17         started        signatures5 process6 dnsIp7 78 185.209.22.181, 29234, 49781 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 17->78 80 cdn.discordapp.com 162.159.134.233, 443, 49789 CLOUDFLARENETUS United States 17->80 70 C:\Users\user\AppData\Local\Temp\build.exe, PE32+ 17->70 dropped 98 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->98 100 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 17->100 102 Tries to harvest and steal browser information (history, passwords, etc) 17->102 104 Tries to steal Crypto Currency Wallets 17->104 22 build.exe 17->22         started        file8 signatures9 process10 signatures11 114 Antivirus detection for dropped file 22->114 116 Multi AV Scanner detection for dropped file 22->116 118 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->118 120 4 other signatures 22->120 25 conhost.exe 4 22->25         started        process12 file13 74 C:\Users\user\services32.exe, PE32+ 25->74 dropped 134 Drops PE files to the user root directory 25->134 136 Adds a directory exclusion to Windows Defender 25->136 29 cmd.exe 1 25->29         started        31 cmd.exe 1 25->31         started        34 cmd.exe 1 25->34         started        signatures14 process15 signatures16 36 services32.exe 29->36         started        39 conhost.exe 29->39         started        142 Uses schtasks.exe or at.exe to add and modify task schedules 31->142 144 Adds a directory exclusion to Windows Defender 31->144 41 powershell.exe 21 31->41         started        44 conhost.exe 31->44         started        46 powershell.exe 31->46         started        48 conhost.exe 34->48         started        50 schtasks.exe 1 34->50         started        process17 dnsIp18 106 Antivirus detection for dropped file 36->106 108 Multi AV Scanner detection for dropped file 36->108 110 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 36->110 112 4 other signatures 36->112 52 conhost.exe 36->52         started        88 192.168.2.1 unknown unknown 41->88 signatures19 process20 dnsIp21 82 github.com 140.82.113.4, 443, 49822 GITHUBUS United States 52->82 84 raw.githubusercontent.com 185.199.108.133, 443, 49828 FASTLYUS Netherlands 52->84 86 sanctam.net 52->86 72 C:\Users\user\AppData\...\sihost32.exe, PE32+ 52->72 dropped 122 Adds a directory exclusion to Windows Defender 52->122 57 sihost32.exe 52->57         started        60 cmd.exe 52->60         started        file22 signatures23 process24 signatures25 124 Antivirus detection for dropped file 57->124 126 Multi AV Scanner detection for dropped file 57->126 128 Writes to foreign memory regions 57->128 132 2 other signatures 57->132 62 conhost.exe 57->62         started        130 Adds a directory exclusion to Windows Defender 60->130 64 conhost.exe 60->64         started        66 powershell.exe 60->66         started        68 powershell.exe 60->68         started        process26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c790dc9174daf4135dcfdc30aad3ba8df18fc1cf4ce549c51501fa7eb7be38d/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 20:37:29 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pr4q3sixjwxucno47xbqvlj3vdprr7a46thfjhcrkap2p2334ogq._file
Verdict:
malicious
Similar samples:
5357372d858b551ca90eda32f7ce00c85e1894c77cce1a5c1fa0c0dace605d42
RedLineStealer
65ac41a575bef9b2c3bccc5699bdd6962e4bc7b30618ac876a880e3528c50493
RedLineStealer
777fe8a5d9fee21eb0ad8490b29ad99d321afce48739d306b420ea4e92697975
RedLineStealer
86f4809b73e73c837784b2a9a449d1d56f34ea22bd30b99a555962683113cde7
RedLineStealer
914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e
RedLineStealer
a059841f9de1c6f01abf02a6f111f871185ff8cfcbfb8a841bb2401164960fe8
RedLineStealer
d1b138a211d4b9ce4d825f82669ba211e585a87eec0e877a2b8ef87a9e43ccb6
RedLineStealer
+ 2'020 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211028-aewzvagge4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.209.22.181:29234
Unpacked files
SH256 hash:
4e54c19b28442b75faaf2801422589317bcb1f7707a837d1c33b1a068d24a531
MD5 hash:
f5fb394a597ef5ffbbcd8082a2ce95cf
SHA1 hash:
76c8204ed8bbc11da93f5d525295ad9e04ec0a90
Link:
https://www.unpac.me/results/ea97d521-5d00-401b-b5ef-de9217aa8e91/
SH256 hash:
7c790dc9174daf4135dcfdc30aad3ba8df18fc1cf4ce549c51501fa7eb7be38d
MD5 hash:
9a7146fc6a650f4e344aa8102c5986e2
SHA1 hash:
4dc9554e75fa372a7ffc963f0bc25308213d19e7
Link:
https://www.unpac.me/results/ea97d521-5d00-401b-b5ef-de9217aa8e91/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7c790dc9174d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c790dc9174daf4135dcfdc30aad3ba8df18fc1cf4ce549c51501fa7eb7be38d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 7c790dc9174daf4135dcfdc30aad3ba8df18fc1cf4ce549c51501fa7eb7be38d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1721809/
Cape
Cape
https://www.capesandbox.com/analysis/200726/

Comments


Avatar
zbet commented on 2021-10-28 00:07:36 UTC

url : hxxp://193.142.59.113/forum/uploads/163.exe