MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82602bf557ca318bac0838154b08da9d413c8388f24a88b6b8620cf5087a90e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82602bf557ca318bac0838154b08da9d413c8388f24a88b6b8620cf5087a90e6
SHA3-384 hash: 71a37e8b87e87f4cf3e886ff992d48f28daeda899dd980e251d42424277c818226505b5de9c6feefae1e3764ddb4726a
SHA1 hash: 5850bbda5d3bc614534f77097ae28a383341e4b7
MD5 hash: 317fa49194773ba5f2c25215220875a5
humanhash: bulldog-mississippi-virginia-coffee
File name:317fa49194773ba5f2c25215220875a5.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:401'408 bytes
First seen:2023-09-26 11:35:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a8ff080ef62a495516b8728c68884f40 (3 x RedLineStealer, 1 x Stealc, 1 x Smoke Loader)
ssdeep 6144:MT3h0BMNZ2JqviqIXpu9EHJoQYWYyOjUWaJ582:MN6MNUJqvypuEHSpY5
TLSH T14B848D0393E17CD0F5264B329E2EDEE876DDF5104E99776A22D89A2F09B01F2D263711
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 70d0ded0d4ccd2dd (4 x RedLineStealer, 1 x LummaStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
64.40.154.6:36512

Intelligence

File Origin
# of uploads :
1
# of downloads :
284
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
317fa49194773ba5f2c25215220875a5.exe
Verdict:
Malicious activity
Analysis date:
2023-09-26 11:36:35 UTC
Tags:
gcleaner loader stealer redline
Link:
https://app.any.run/tasks/4e13f99a-d71e-4068-af50-d062f1e40b55

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
OnlyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/451253/
Detection(s):
Win.Packed.Trojanx-10008988-0
Create hunting rule

Win.Dropper.Glupteba-10009145-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Searching for the window
Reading critical registry keys
Creating a window
Launching a tool to kill processes
Stealing user critical data
Sending an HTTP GET request to an infection source
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware zusy
Link:
https://www.filescan.io/uploads/6512c222f1b40cb0d622a651/reports/28112070-ec63-4267-86dc-e4d70ca53514/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/82602bf557ca318bac0838154b08da9d413c8388f24a88b6b8620cf5087a90e6
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e19039ce-af66-422b-9202-2faee3cda21c
Result
Threat name:
RedLine, onlyLogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1314459
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected onlyLogger
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314459 Sample: 0CLyZ10MZR.exe Startdate: 26/09/2023 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Multi AV Scanner detection for domain / URL 2->50 52 Found malware configuration 2->52 54 14 other signatures 2->54 7 0CLyZ10MZR.exe 19 2->7         started        process3 dnsIp4 34 5.42.64.10, 49781, 49782, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 7->34 36 script.google.com 172.217.3.78, 443, 49783, 49784 GOOGLEUS United States 7->36 38 2 other IPs or domains 7->38 26 C:\Users\user\AppData\...\0758791841.exe, PE32 7->26 dropped 28 C:\Users\user\AppData\Local\...\s51[1], PE32 7->28 dropped 30 C:\Users\user\AppData\Local\...\s51[1], PE32 7->30 dropped 56 Detected unpacking (changes PE section rights) 7->56 58 Detected unpacking (overwrites its own PE header) 7->58 12 cmd.exe 1 7->12         started        14 cmd.exe 1 7->14         started        file5 signatures6 process7 process8 16 0758791841.exe 4 12->16         started        20 conhost.exe 12->20         started        22 taskkill.exe 1 14->22         started        24 conhost.exe 14->24         started        dnsIp9 32 64.40.154.6, 36512, 49786 1P-WSSUS United States 16->32 40 Antivirus detection for dropped file 16->40 42 Multi AV Scanner detection for dropped file 16->42 44 Detected unpacking (changes PE section rights) 16->44 46 7 other signatures 16->46 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82602bf557ca318bac0838154b08da9d413c8388f24a88b6b8620cf5087a90e6/
Threat name:
Win32.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2023-09-23 19:52:10 UTC
File Type:
PE (Exe)
Extracted files:
37
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjqcx5kxziyyxlaihakuwcg2tvatza4i6jfirnvymigpkcd2sdta._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/230926-nqkb3sac62/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
.NET Reactor proctector
Checks computer location settings
Deletes itself
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
RedLine
RedLine payload
Unpacked files
SH256 hash:
ba34c8ca4d21841ec006188cd061e81c0b22376799c8a22759d6bdbf0ddf066d
MD5 hash:
c8c88b356339a169e10864cb9d743cfd
SHA1 hash:
9c8f172444e1e545111fe15d0ad9c3cd425e13c2
Link:
https://www.unpac.me/results/7eba2b10-ede7-4818-8cd6-8f11943ac120/
SH256 hash:
82602bf557ca318bac0838154b08da9d413c8388f24a88b6b8620cf5087a90e6
MD5 hash:
317fa49194773ba5f2c25215220875a5
SHA1 hash:
5850bbda5d3bc614534f77097ae28a383341e4b7
Link:
https://www.unpac.me/results/7eba2b10-ede7-4818-8cd6-8f11943ac120/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/82602bf557ca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82602bf557ca318bac0838154b08da9d413c8388f24a88b6b8620cf5087a90e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_OnlyLogger
Create hunting rule
Author:ditekSHen
Description:Detects OnlyLogger loader variants
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_gcleaner_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.gcleaner.
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451253/

Comments