MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d
SHA3-384 hash: 855e6163bc6f0c8bf36231879252ceb9f78bbfc36a35e7ea6e137aa37afad2d11d8c63c5a4aee874dee9933e686b7167
SHA1 hash: 7a67b4431f2e9a7cb66c01cf6d870d03688bf397
MD5 hash: 8b5b45da8a4ebf7b690fcae5411b4959
humanhash: lithium-california-april-whiskey
File name:8b5b45da8a4ebf7b690fcae5411b4959
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'953'248 bytes
First seen:2021-12-23 20:41:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1fa76919e37ff0bc4bfa464ff0a236f2 (1 x RedLineStealer)
ssdeep 49152:L0kVoTgIdwd7YTx36ls3KFWJ/jmErtsREhpnCr2AnRlbIbM:pmwWJ8oKFWNCrR2QRlEb
Threatray 3'625 similar samples on MalwareBazaar
TLSH T14195004D6950A840CEED2E39E9327DAC04568F30D7DA892B93D5FEBE7A1F4E17101923
File icon (PE):PE icon
dhash icon 6996d4ccccdcd60e (1 x RedLineStealer)
Reporter zbetcheckin
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8b5b45da8a4ebf7b690fcae5411b4959
Verdict:
Malicious activity
Analysis date:
2021-12-23 20:42:28 UTC
Tags:
trojan rat redline evasion stealer vidar loader
Link:
https://app.any.run/tasks/9f8e5d57-726e-4ed4-b4dd-1c6b07765242

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/216022/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.32369.21130.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a process
Creating a file
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3039/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61c4df208991ba72b3943be2/reports/9c84c0ae-e1f7-402a-8f42-10a41515776b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d37db1cd-643a-48d8-81c2-eaf9c1206bf1
Result
Threat name:
RedLine Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/912188
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 544666 Sample: q2vbbzoxoZ Startdate: 23/12/2021 Architecture: WINDOWS Score: 100 66 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->66 68 Multi AV Scanner detection for domain / URL 2->68 70 Found malware configuration 2->70 72 8 other signatures 2->72 8 q2vbbzoxoZ.exe 15 19 2->8         started        process3 dnsIp4 54 loanssupersale.online 45.88.106.24, 49754, 54387 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Netherlands 8->54 56 altriors.xyz 80.92.206.95, 443, 49757 HELIOSNET-ASRU Russian Federation 8->56 34 C:\Users\user\AppData\Local\Temp\srrvs.exe, PE32 8->34 dropped 36 C:\Users\user\AppData\...\q2vbbzoxoZ.exe.log, ASCII 8->36 dropped 74 Detected unpacking (changes PE section rights) 8->74 76 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->76 78 Tries to detect sandboxes and other dynamic analysis tools (window names) 8->78 80 5 other signatures 8->80 13 srrvs.exe 76 8->13         started        18 chrome.exe 13 214 8->18         started        file5 signatures6 process7 dnsIp8 58 65.108.180.72, 49759, 80 ALABANZA-BALTUS United States 13->58 60 mstdn.social 116.202.14.219, 443, 49758 HETZNER-ASDE Germany 13->60 38 C:\Users\user\AppData\...\msvcp140[1].dll, PE32 13->38 dropped 40 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 13->40 dropped 42 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 13->42 dropped 46 9 other files (none is malicious) 13->46 dropped 82 Detected unpacking (changes PE section rights) 13->82 84 Detected unpacking (overwrites its own PE header) 13->84 86 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->86 88 2 other signatures 13->88 20 cmd.exe 1 13->20         started        62 192.168.2.1 unknown unknown 18->62 64 239.255.255.250 unknown Reserved 18->64 44 C:\Users\user\AppData\Local\...\History, SQLite 18->44 dropped 22 chrome.exe 14 18->22         started        file9 signatures10 process11 dnsIp12 26 conhost.exe 20->26         started        28 taskkill.exe 20->28         started        30 timeout.exe 20->30         started        48 iplogger.org 148.251.234.83, 443, 49763, 49767 HETZNER-ASDE Germany 22->48 50 googlehosted.l.googleusercontent.com 172.217.168.1, 443, 49800 GOOGLEUS United States 22->50 52 5 other IPs or domains 22->52 32 C:\Users\user\AppData\Local\...\Cookies, SQLite 22->32 dropped file13 process14
Detection:
vidar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-12-23 19:23:19 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
25 of 43 (58.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qoc6w6yyvca5z7nyoqdkslazwwzzm5xv3zqilgskia2m7epcdrwq._file
Verdict:
malicious
Similar samples:
4290f5fbbd5d7ff8054de896fe4231d83a149f099ee867c75969468e0078e8f1
RedLineStealer
48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027
RedLineStealer
b7b8931f7442c2cff8c9df6a8a216ed280c7ea29ea97c30e3147c99a991df0cd
RedLineStealer
c30aa98a123e2dfaee73e1f0145d014ff781687184578d6cbd98a45c81d288d4
RedLineStealer
caeab7a886965dffc43ceb230217b9903b87246f8c1edc1417f75572064a0f29
RedLineStealer
cebf4c9af84506f3b683d5d4867b739244b6ba595772d583b3455781c4d91b74
RedLineStealer
d36f009c2288e60e7516b6118258cc18b693683dd9901d0a15e59f6f00b6a17d
RedLineStealer
d51d87ce93b1f39f87f0debd1122aa7721e5e4fa9f7f615c4c17bd90f12da71d
RedLineStealer
+ 3'615 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:mimikatz family:redline family:vidar botnet:916 discovery infostealer spyware stealer suricata
Link:
https://tria.ge/reports/211223-zg1s9acddn/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
mimikatz is an open source tool to dump credentials on Windows
Mimikatz
RedLine
RedLine Payload
Vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
Malware Config
C2 Extraction:
https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8
Unpacked files
SH256 hash:
8a19ae30556df1f661dc02edc3a639ce99f865d87477f612c2f32fd603054804
MD5 hash:
91c3406d6decd8a66a5c0fcf941f80b8
SHA1 hash:
86ab4920a764bdba4867a511abd3138701cbd52a
Link:
https://www.unpac.me/results/82d3c290-c27c-4e77-b0d5-f796af255d53/
SH256 hash:
8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d
MD5 hash:
8b5b45da8a4ebf7b690fcae5411b4959
SHA1 hash:
7a67b4431f2e9a7cb66c01cf6d870d03688bf397
Link:
https://www.unpac.me/results/82d3c290-c27c-4e77-b0d5-f796af255d53/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8385eb7b18a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8385eb7b18a881dcfdb87406a92c19b5b39676f5de60859a4a4034cf91e21c6d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1915067/
Cape
Cape
https://www.capesandbox.com/analysis/216022/

Comments


Avatar
zbet commented on 2021-12-23 20:41:10 UTC

url : hxxp://data-file-data-7.com/files/4262_1640254886_5058.exe