MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d
SHA3-384 hash: b657ee0c55fd9a2d584d92664b31d01ffb42f42c618c73b5891c76f2563c14b931cfe2aa514a82b9e4acb987630e8a26
SHA1 hash: 6bb56e14ee820e11093cdd63bd6b493bbbad7915
MD5 hash: d8bab14ea6b73ec07acfdedbdb81ac68
humanhash: fifteen-fanta-spaghetti-november
File name:6bb56e14ee820e11093cdd63bd6b493bbbad7915.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:11'776 bytes
First seen:2021-11-26 04:15:32 UTC
Last seen:2021-11-26 05:46:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 192:/rUXCst69f/0Q2dFZl2zbpWl3hLV6prZMY5JgJ:/AXzt69UD2zbQlxLEZJ7g
Threatray 275 similar samples on MalwareBazaar
TLSH T131321A457BE8867AD2FE4E7509F393108131E7479862CEAF3CC8508E6D637844661FBA
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
95.181.152.177:21142

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.181.152.177:21142 https://threatfox.abuse.ch/ioc/254437/

Intelligence

File Origin
# of uploads :
2
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://crackedfine.com/lumion-pro-crack-2/
Verdict:
Malicious activity
Analysis date:
2021-11-22 13:20:29 UTC
Tags:
trojan rat redline evasion loader stealer opendir vidar
Link:
https://app.any.run/tasks/47eaedfc-e0df-481c-8a66-61b2d1e4e764

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.49979.4414.13854.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Creating a file
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Searching for the window
Enabling the 'hidden' option for recently created files
Launching the default Windows debugger (dwwin.exe)
Launching a process
Sending an HTTP POST request
Reading critical registry keys
Creating a window
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
donut obfuscated packed
Link:
https://www.filescan.io/uploads/61a05f85f36138de3f3e0541/reports/10e8866d-9fb0-4350-aeb0-250f1ccb29c2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4a958d3f-bc52-403b-9e1e-82cd8fb4d773
Result
Threat name:
Raccoon RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/896480
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 528958 Sample: j3vI8t0oTv.exe Startdate: 26/11/2021 Architecture: WINDOWS Score: 100 85 cdn.discordapp.com 2->85 111 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->111 113 Multi AV Scanner detection for domain / URL 2->113 115 Found malware configuration 2->115 117 11 other signatures 2->117 11 j3vI8t0oTv.exe 15 7 2->11         started        15 driver.exe 2->15         started        18 ChromeUpdater_Master.exe 2->18         started        signatures3 process4 dnsIp5 93 cdn.discordapp.com 162.159.129.233, 443, 49744, 49749 CLOUDFLARENETUS United States 11->93 95 195.133.18.20, 49743, 49745, 49746 AS-REGRU Russian Federation 11->95 97 192.168.2.1 unknown unknown 11->97 69 C:\Users\user\AppData\...\j3vI8t0oTv.exe.log, ASCII 11->69 dropped 71 C:\Users\user\...\ChromeUpdater_Master.exe, PE32 11->71 dropped 20 ChromeUpdater_Master.exe 15 7 11->20         started        24 cmd.exe 1 11->24         started        99 ccf9ba3695b15b4f0787e6290e0f63allcomejroo839jxi13.xyz 207.244.237.176, 49770, 80 CONTABOUS United States 15->99 133 Performs DNS queries to domains with low reputation 15->133 26 conhost.exe 15->26         started        file6 signatures7 process8 dnsIp9 87 51.178.13.96, 9999 OVHFR France 20->87 89 162.159.130.233, 443, 49747 CLOUDFLARENETUS United States 20->89 91 2 other IPs or domains 20->91 63 C:\...\B2342A85F77B8E254BF882E15921E911.exe, PE32 20->63 dropped 65 C:\...\5835F27E062417D3C161E0F9734AEEFB.exe, PE32 20->65 dropped 67 C:\...\2D62E212E80CD97D781296C2D1FA7227.exe, PE32 20->67 dropped 28 B2342A85F77B8E254BF882E15921E911.exe 20->28         started        33 2D62E212E80CD97D781296C2D1FA7227.exe 82 20->33         started        35 5835F27E062417D3C161E0F9734AEEFB.exe 4 20->35         started        37 2D62E212E80CD97D781296C2D1FA7227.exe 20->37         started        39 conhost.exe 24->39         started        file10 process11 dnsIp12 101 95.181.152.177, 21142, 49907, 50223 MSKHOSTRU Russian Federation 28->101 103 api.ip.sb 28->103 73 B2342A85F77B8E254BF882E15921E911.exe.log, ASCII 28->73 dropped 119 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 28->119 121 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->121 123 Tries to harvest and steal browser information (history, passwords, etc) 28->123 125 Tries to steal Crypto Currency Wallets 28->125 41 conhost.exe 28->41         started        105 193.38.54.238, 80 SERVERIUS-ASNL Russian Federation 33->105 107 91.219.236.162, 80 SERVERASTRA-ASHU Hungary 33->107 109 5 other IPs or domains 33->109 75 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 33->75 dropped 77 C:\Users\user\AppData\...\vcruntime140.dll, PE32 33->77 dropped 79 C:\Users\user\AppData\...\ucrtbase.dll, PE32 33->79 dropped 83 56 other files (none is malicious) 33->83 dropped 127 Creates HTML files with .exe extension (expired dropper behavior) 33->127 129 Tries to steal Mail credentials (via file / registry access) 33->129 43 cmd.exe 33->43         started        45 WerFault.exe 33->45         started        81 C:\Users\user\AppData\Local\...\driver.exe, PE32 35->81 dropped 131 Uses schtasks.exe or at.exe to add and modify task schedules 35->131 47 schtasks.exe 35->47         started        49 conhost.exe 35->49         started        file13 signatures14 process15 process16 51 conhost.exe 43->51         started        53 timeout.exe 43->53         started        55 ChromeUpdater_Master.exe 47->55         started        57 conhost.exe 47->57         started        59 conhost.exe 49->59         started        process17 61 WerFault.exe 55->61         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d/
Threat name:
ByteCode-MSIL.Trojan.Regrun
Create hunting rule
Status:
Malicious
First seen:
2021-11-23 03:44:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=riryicoi4gbmyac3xsusgoadcso3hubgbvjemejprnumlio7uvgq._file
Verdict:
malicious
Similar samples:
0d62bb4a0b9c5d7684491458a0759551373a0fb211f062705ae0cafe1ac1a605
RedLineStealer
51160ae1edfcf45c5e3e6e1bedc4a5bdcfc27d5e23cb08c511ecd43b816b4c08
RedLineStealer
522fba71f8b27f706deb2caee46b1c5350c41decc21be032bb9a447a0d34c698
RedLineStealer
7b91e9f9e71958ca487aabd657b044009703e38861e743984ff976bfb02f6aa4
RedLineStealer
9e158664ac351f8ea38f3a0c288d58e3bea0264a989da36448c6fc78a82bea98
RedLineStealer
ed9d17ee70ce16c077354f25f3c0161d52bf91ae83d48118a7902a48d88926d3
RedLineStealer
+ 265 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline botnet:34b5c357572382155552cb40207e952f9f95264b botnet:cheat discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/211126-evta4sdfd9/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Drops desktop.ini file(s)
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Raccoon
RedLine
RedLine Payload
Malware Config
C2 Extraction:
95.181.152.177:21142
Unpacked files
SH256 hash:
8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d
MD5 hash:
d8bab14ea6b73ec07acfdedbdb81ac68
SHA1 hash:
6bb56e14ee820e11093cdd63bd6b493bbbad7915
Link:
https://www.unpac.me/results/b9b70613-c24b-4433-a4d3-5da4826b1e78/
Malware family:
RedLine.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8a238409c8e1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_Raccoon
Create hunting rule
Author:ditekSHen
Description:Raccoon stealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_raccoon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.raccoon.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/209578/

Comments