MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118
SHA3-384 hash: b9731101d7d5595e1e4d0b7c789c1418275ae78c1e5c1e73e6b7dfe22926ba77d8c7ecc93e1f2f6da51f458027162b62
SHA1 hash: 0a44f235746d86c350f5db8ae2b807fbe3ca43c8
MD5 hash: 23d937226d61dd1c9196ce59aca7cb4f
humanhash: double-apart-aspen-october
File name:Genshin Impact Hack Global.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'564'032 bytes
First seen:2022-01-08 07:42:27 UTC
Last seen:2022-01-08 09:34:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c284fa365c4442728ac859c0f9ed4dc5 (94 x RedLineStealer, 10 x RaccoonStealer, 8 x CoinMiner)
ssdeep 98304:/Ak2fHr6xap5HoYwxRcC2SFBn457esKK/66tJ7oJI:/f2fHrsaTIYIpzU6uoJI
Threatray 225 similar samples on MalwareBazaar
TLSH T1B1F53308F182AB25CB97C9703D9A749C4A9313DC59D1104BDF96166FFFACA924DCCCA8
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Genshin Impact Hack Global.exe
Verdict:
Malicious activity
Analysis date:
2022-01-08 07:47:01 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/30a86e22-825f-4ad9-9b30-4517c5e53dfd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/217800/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
DNS request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61d9408c1c0d769df9d7d463/reports/9ca62424-28da-4f68-a5c1-ef5aa2da26d4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e01f5e74-dce0-4e5d-95b3-56fd7f95efbc
Result
Threat name:
BitCoin Miner RedLine SilentXMRMiner Xmr
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/917108
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Detected VMProtect packer
Drops PE files with benign system names
Found malware configuration
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: System File Execution Location Anomaly
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Yara detected SilentXMRMiner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 549585 Sample: Genshin Impact Hack Global.exe Startdate: 08/01/2022 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Yara detected SilentXMRMiner 2->51 53 Yara detected BitCoin Miner 2->53 55 9 other signatures 2->55 9 Genshin Impact Hack Global.exe 2->9         started        process3 signatures4 65 Writes to foreign memory regions 9->65 67 Allocates memory in foreign processes 9->67 69 Injects a PE file into a foreign processes 9->69 12 AppLaunch.exe 15 7 9->12         started        17 WerFault.exe 23 9 9->17         started        process5 dnsIp6 43 91.243.59.37, 49740, 61742 MATTEOGB Russian Federation 12->43 45 cdn.discordapp.com 162.159.130.233, 443, 49745 CLOUDFLARENETUS United States 12->45 41 C:\Users\user\AppData\Local\...\applaunch.exe, PE32+ 12->41 dropped 73 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 12->73 75 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 12->75 77 Tries to harvest and steal browser information (history, passwords, etc) 12->77 79 Tries to steal Crypto Currency Wallets 12->79 19 applaunch.exe 4 12->19         started        47 192.168.2.1 unknown unknown 17->47 file7 signatures8 process9 file10 39 C:\Users\user\AppData\...\services.exe, PE32+ 19->39 dropped 57 Antivirus detection for dropped file 19->57 59 Multi AV Scanner detection for dropped file 19->59 61 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 19->61 63 2 other signatures 19->63 23 cmd.exe 1 19->23         started        25 cmd.exe 1 19->25         started        28 backgroundTaskHost.exe 38 29 19->28         started        signatures11 process12 signatures13 30 services.exe 2 23->30         started        33 conhost.exe 23->33         started        71 Uses schtasks.exe or at.exe to add and modify task schedules 25->71 35 conhost.exe 25->35         started        37 schtasks.exe 1 25->37         started        process14 signatures15 81 Antivirus detection for dropped file 30->81 83 Multi AV Scanner detection for dropped file 30->83 85 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 30->85 87 Tries to detect virtualization through RDTSC time measurements 30->87
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-01-08 07:43:17 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
21 of 43 (48.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qfb4mnrr35ilsxgpyr4cf6ai7p7sfdy5utvv4uq4mnjpxrty2ema._file
Verdict:
malicious
Similar samples:
4b53dc815775a5f6d377218f9bee6b102d49f5dfc678f5a939ec2e0be0890e4b
RedLineStealer
5285ffebc00e0e75efcb1944329d1708d658eb5b4e5928d191323d933a3673e4
RedLineStealer
5ed9c8e4709af1af34ea8d1e6d5177c3d164c62c7dece9adcdd3d9c1b402484f
RedLineStealer
8a76fd10a479dbf5bb5d60f6ef949641d2ef4f1262a6d9dd273cf93b7be934b3
RedLineStealer
9c55d8b1e171b21b41833dcbab1b07157f3bd3a12a06578c9063a211bb0bc61e
RedLineStealer
9fcaa9da6fe7fa15f35c891d33764bd8d47e7e87702aae69c1d48612f97b3956
RedLineStealer
ed12366797816cbbe1a54c425680db408accd164ecc3f7488f5d89cae0459a87
RedLineStealer
+ 215 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220108-jj9aeacha2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Unpacked files
SH256 hash:
0553a048e80aacd5faf0b622163a95be948d4496e15dcbeb1b48de67f912b499
MD5 hash:
de9b8c0062ca2d4e9008237608196d6d
SHA1 hash:
491311cc6a5677e61e0baf4090c4bd54f7186c77
Link:
https://www.unpac.me/results/2b13e327-f04f-4633-b9a8-6ce17d87e97f/
SH256 hash:
8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118
MD5 hash:
23d937226d61dd1c9196ce59aca7cb4f
SHA1 hash:
0a44f235746d86c350f5db8ae2b807fbe3ca43c8
Link:
https://www.unpac.me/results/2b13e327-f04f-4633-b9a8-6ce17d87e97f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8143c63631df50b95ccfc47822f808fbff228f1da4eb5e521c6352fbc678d118

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/217800/

Comments