MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8601e0cb03c84f71b1357d0518210906ceb078c7c69e1346ad39d2ed6cca2a53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8601e0cb03c84f71b1357d0518210906ceb078c7c69e1346ad39d2ed6cca2a53
SHA3-384 hash: 6522c5f77d142b5df1f399e3d5ce2a9c25823ac73b5d77e681cd6721c1ec694e3f82e490c4cd43dc185ceae21665fd3f
SHA1 hash: 6dc4fcd8c5520bf74f9f9363812957e0630203b5
MD5 hash: dfd0e2806dcce9154f04c8a2ab75b47f
humanhash: happy-skylark-social-lactose
File name:8601e0cb03c84f71b1357d0518210906ceb078c7c69e1.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:521'216 bytes
First seen:2022-11-12 02:25:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e76c6ebb259337a0f26e3cdd8f85ac5b (2 x RedLineStealer, 1 x DarkComet)
ssdeep 12288:ymGleQ9A1Vko+niLXWCMOxW8Yml31t/nFu6K3wFATtZELRZSQ:HGlj9AB+iLXWTOw8Ymllt/F7QZ+R
TLSH T12CB423A9D58FEAF2D4629EB752EDB904BE9AD05101A80463C5E55C5E00B3F73406F82F
TrID 54.9% (.EXE) UPX compressed Win32 Executable (27066/9/6)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
4.1% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
94.140.114.248:81

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
8601e0cb03c84f71b1357d0518210906ceb078c7c69e1.exe
Verdict:
Malicious activity
Analysis date:
2022-11-12 03:42:13 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/1fd2ff47-213a-4e40-a71f-befb9bb78d56

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332728/
Detection(s):
Win.Malware.Lazy-9976893-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Searching for the window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/51534/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/636f043a20a0b4943a8f0393/reports/56313243-d46a-4918-b142-81084af0c2b4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8cc5241f-9050-49db-b122-e22a85778eb6
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1111647
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 744343 Sample: 8601e0cb03c84f71b1357d05182... Startdate: 12/11/2022 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus / Scanner detection for submitted sample 2->53 55 6 other signatures 2->55 7 8601e0cb03c84f71b1357d0518210906ceb078c7c69e1.exe 4 2->7         started        process3 file4 35 C:\Users\user\AppData\Local\Temp\WL.EXE, PE32 7->35 dropped 37 C:\Users\user\AppData\Local\Temp\REI.EXE, PE32 7->37 dropped 39 C:\Users\user\AppData\Local\Tempbehaviorgraph.EXE, PE32 7->39 dropped 10 G.EXE 1 7->10         started        13 WL.EXE 1 7->13         started        15 REI.EXE 1 7->15         started        process5 signatures6 67 Antivirus detection for dropped file 10->67 69 Multi AV Scanner detection for dropped file 10->69 71 Machine Learning detection for dropped file 10->71 73 Contains functionality to inject code into remote processes 10->73 17 AppLaunch.exe 3 10->17         started        21 conhost.exe 10->21         started        23 WerFault.exe 10->23         started        75 Writes to foreign memory regions 13->75 77 Allocates memory in foreign processes 13->77 79 Injects a PE file into a foreign processes 13->79 25 AppLaunch.exe 13->25         started        27 conhost.exe 13->27         started        29 AppLaunch.exe 15->29         started        31 conhost.exe 15->31         started        33 WerFault.exe 15->33         started        process7 dnsIp8 41 193.106.191.160, 49714, 8673 BOSPOR-ASRU Russian Federation 17->41 57 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->57 59 Performs DNS queries to domains with low reputation 17->59 61 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 17->61 43 62.204.41.141, 24758, 49713 TNNET-ASTNNetOyMainnetworkFI United Kingdom 25->43 63 Tries to harvest and steal browser information (history, passwords, etc) 25->63 65 Tries to steal Crypto Currency Wallets 25->65 45 tininshassama.xyz 94.140.114.248, 49715, 81 NANO-ASLV Latvia 29->45 47 api.ip.sb 29->47 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8601e0cb03c84f71b1357d0518210906ceb078c7c69e1346ad39d2ed6cca2a53/
Threat name:
Win32.Trojan.ArkeiStealer
Create hunting rule
Status:
Malicious
First seen:
2022-11-10 17:19:00 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qya6bsydzbhxdmjvpucrqiija3hla6ghy2pbgrvnhhjo23gkfjjq._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@moriwws infostealer spyware upx
Link:
https://tria.ge/reports/221112-cwvt8agd2y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
UPX packed file
RedLine
RedLine payload
Malware Config
C2 Extraction:
62.204.41.141:24758
193.106.191.160:8673
tininshassama.xyz:81
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/786348c4-4100-4c65-9516-f9f9d0a7ca85
Unpacked files
SH256 hash:
640ea310c803882e91e96b3b3d1ddc20060e0bbfd9cb7d84778b8c0e33bc1f85
MD5 hash:
575bac24a21c057094ecd819e7f832db
SHA1 hash:
316c54c560b177ba73ea9a65170464396dbcc304
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/395c017a-9c8e-467b-93c7-16f12eeab229/
SH256 hash:
be406d50674415cf95c81e4292314de20f7ecb4298d82c7e6b1ad645b13da0ca
MD5 hash:
23e3f1131ba6f25c0abd3d27084df597
SHA1 hash:
d27b27d9b79d75f34a8a5e5947c1931049dc6210
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/395c017a-9c8e-467b-93c7-16f12eeab229/
SH256 hash:
7979904160799b4f34afd6ea36d0afa6bb9361fd8955c65626cbd7a90dfe1cee
MD5 hash:
33af1db676a93b9d16436fc1b098e52f
SHA1 hash:
f332be61dc9246538c1a615f77f5edcc54b09969
Link:
https://www.unpac.me/results/395c017a-9c8e-467b-93c7-16f12eeab229/
SH256 hash:
b452bcdea0380958824ff6f326fa40fc309524a83633af38dbfbe1461701307a
MD5 hash:
0fba39404ca24dd09d93fcdd8d3768b6
SHA1 hash:
fb450a480d4f7de7a10275a8e3535a1cee3bdfc3
Link:
https://www.unpac.me/results/395c017a-9c8e-467b-93c7-16f12eeab229/
SH256 hash:
6d90531f56a38b1e4d88bb6c2e8b208adc9f59fe3dd4e653777f5604368d6563
MD5 hash:
5b6f52cb4f7efd2c52ae0af61b485505
SHA1 hash:
7ba4cd711868c1237539f88251216afa9bbaa958
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/395c017a-9c8e-467b-93c7-16f12eeab229/
Parent samples :
8601e0cb03c84f71b1357d0518210906ceb078c7c69e1346ad39d2ed6cca2a53
160625fc9d9070b64847cad9582f16da0ddc6ed074ae3d07ec33e9ea4e28e1c2
SH256 hash:
8601e0cb03c84f71b1357d0518210906ceb078c7c69e1346ad39d2ed6cca2a53
MD5 hash:
dfd0e2806dcce9154f04c8a2ab75b47f
SHA1 hash:
6dc4fcd8c5520bf74f9f9363812957e0630203b5
Link:
https://www.unpac.me/results/395c017a-9c8e-467b-93c7-16f12eeab229/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8601e0cb03c84f71b1357d0518210906ceb078c7c69e1346ad39d2ed6cca2a53

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/332728/

Comments