MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 9 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c
SHA3-384 hash: 3411b73a035409740a2af6cdb1990d58af864cbe2d9942f25da58988088333722cfb60d8aae65b0581d531781cd9939f
SHA1 hash: 5d3db9376a7581fad4db73b87bcf6ce555e6138b
MD5 hash: 623bca798c05a1e5dc5a26ff57329459
humanhash: avocado-hamper-echo-zulu
File name:623bca798c05a1e5dc5a26ff57329459
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'457'728 bytes
First seen:2023-07-17 16:49:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:magq7j1kTKNpT+1OzKamfw3Fryxqu4m/YjsqV51RoipOm5FGWCmP9:Zgq7STKNUA7mfEO4cYjsq1RoinZCml
Threatray 669 similar samples on MalwareBazaar
TLSH T1E0B533C77D18D84CCAE724F4E57B5374A9F5E93DA8C4235CF9A52708AA226F2600F253
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon d8dcdcdcdccccccc (1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer signed

Code Signing Certificate

Organisation:Hewlett-Packard Company
Issuer:Hewlett-Packard Company
Algorithm:sha1WithRSAEncryption
Valid from:2023-07-16T17:53:21Z
Valid to:2033-07-17T17:53:21Z
Serial number: 19c7e09e1425d8b8485da7438ffd570c
Intelligence: 15 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 6ba12c4c5504cad206d7bafb82e4c596759828e45bf51b0aaefa99ea5eb20187
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
317
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
623bca798c05a1e5dc5a26ff57329459
Verdict:
Malicious activity
Analysis date:
2023-07-17 16:52:22 UTC
Tags:
rat redline
Link:
https://app.any.run/tasks/39ceba16-93f8-4752-b587-a116a455bf5f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/422819/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.20583.11843.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Forced shutdown of a system process
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed packed
Link:
https://www.filescan.io/uploads/64b5713bc7643f862f33d3e2/reports/a464a13c-f5ce-49ee-897e-ba80e1ad4000/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7128a17d-ba2a-4a00-a48b-47b33f6ee0c7
Result
Threat name:
Laplas Clipper, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1274591
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Creates files in the system32 config directory
Detected unpacking (changes PE section rights)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Stop multiple services
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Yara detected Laplas Clipper
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1274591 Sample: aat7aDu7Zm.exe Startdate: 17/07/2023 Architecture: WINDOWS Score: 100 84 lpls.tuktuk.ug 2->84 106 Snort IDS alert for network traffic 2->106 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 13 other signatures 2->112 12 aat7aDu7Zm.exe 1 2->12         started        16 updater.exe 2->16         started        18 cmd.exe 1 2->18         started        20 4 other processes 2->20 signatures3 process4 file5 80 C:\Users\user\AppData\...\aat7aDu7Zm.exe.log, ASCII 12->80 dropped 140 Detected unpacking (changes PE section rights) 12->140 142 Query firmware table information (likely to detect VMs) 12->142 144 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->144 156 3 other signatures 12->156 22 AppLaunch.exe 15 7 12->22         started        27 AppLaunch.exe 12->27         started        82 C:\Windows\Temp\avgcgnkozyev.tmp, PE32+ 16->82 dropped 146 Adds a directory exclusion to Windows Defender 16->146 148 Hides threads from debuggers 16->148 150 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->150 152 Uses powercfg.exe to modify the power settings 18->152 154 Modifies power options to not sleep / hibernate 18->154 29 conhost.exe 18->29         started        31 sc.exe 1 18->31         started        33 sc.exe 1 18->33         started        39 3 other processes 18->39 35 conhost.exe 20->35         started        37 conhost.exe 20->37         started        41 5 other processes 20->41 signatures6 process7 dnsIp8 86 rcam17.tuktuk.ug 85.209.3.4, 11290, 49718 SQUITTER-NETWORKSNL Russian Federation 22->86 88 159.223.216.123, 49719, 80 CELANESE-US United States 22->88 68 C:\Users\user\AppData\Local\...\TaskMnr.exe, PE32+ 22->68 dropped 70 C:\Users\user\AppData\Local\Temp\Octium.exe, MS-DOS 22->70 dropped 118 Tries to harvest and steal browser information (history, passwords, etc) 22->118 120 Tries to steal Crypto Currency Wallets 22->120 43 TaskMnr.exe 2 22->43         started        47 Octium.exe 1 2 22->47         started        122 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 27->122 124 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 27->124 file9 signatures10 process11 file12 72 C:\Users\user\AppData\...\avgcgnkozyev.tmp, PE32+ 43->72 dropped 74 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 43->74 dropped 76 C:\Windows\System32\drivers\etc\hosts, ASCII 43->76 dropped 126 Query firmware table information (likely to detect VMs) 43->126 128 Writes to foreign memory regions 43->128 130 Modifies the context of a thread in another process (thread injection) 43->130 138 4 other signatures 43->138 49 dialer.exe 1 43->49         started        78 C:\Users\user\AppData\Roaming\...\ntlhost.exe, MS-DOS 47->78 dropped 132 Detected unpacking (changes PE section rights) 47->132 134 Hides threads from debuggers 47->134 136 Tries to detect sandboxes / dynamic malware analysis system (registry check) 47->136 52 ntlhost.exe 47->52         started        signatures13 process14 signatures15 90 Writes to foreign memory regions 49->90 92 Allocates memory in foreign processes 49->92 94 Creates a thread in another existing process (thread injection) 49->94 96 Injects a PE file into a foreign processes 49->96 54 lsass.exe 49->54 injected 57 winlogon.exe 49->57 injected 59 svchost.exe 49->59 injected 61 6 other processes 49->61 98 Query firmware table information (likely to detect VMs) 52->98 100 Tries to detect sandboxes and other dynamic analysis tools (window names) 52->100 102 Hides threads from debuggers 52->102 104 Tries to detect sandboxes / dynamic malware analysis system (registry check) 52->104 process16 signatures17 114 Writes to foreign memory regions 54->114 116 Adds a directory exclusion to Windows Defender 54->116 63 powershell.exe 54->63         started        process18 signatures19 158 Creates files in the system32 config directory 63->158 66 conhost.exe 63->66         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-07-17 16:50:07 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmi375renrj4pisirnzxltsqugj2hz5adypzxvefnpcv3eh3tz6a._file
Verdict:
unknown
Similar samples:
2beabdd285adf915fc07418c5f9e57cc4430f766b838e1726570c21af4868f18
RedLineStealer
3dff203bab1db4bd7012e5daa23e467f7919587e5a306e497edb85caa2497dbe
RedLineStealer
46ef6daecec030061841713f7afb387a0a7ce913e2a5d63bc46126628daf19e1
RedLineStealer
753fbc1dfa05d6007c5dfa534a7d019cbb24d07224b67ae9d48c9772039c63cd
RedLineStealer
7997a727f9b2d2bba8f6a846dda7f4640c5b3d1d31db85deb0ef1c4ff05574a4
RedLineStealer
80802d7e4597b03c737d2baa9bb2cb2a400f2c0546218cfa505d408ec5d99b15
RedLineStealer
96e49850a66d17e4952c6753db1f3da67f8c49c23a2297891954df55b144d1a8
RedLineStealer
a4b553e1924688bd6232633b707797ba24efc75f6d7bc0a33cd9c0c00c910e19
RedLineStealer
cc0f70f4c9b185dacf984c2f7f721d11ad293a7e2b654fbf26180e7ebfe54f81
RedLineStealer
d2a3162a538ecf208de5fcc49815c338eb1c71083209e650134dc8b6bd0a6181
RedLineStealer
+ 659 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:170723_rc_11 evasion infostealer spyware themida trojan
Link:
https://tria.ge/reports/230717-vb858ade75/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
Malware Config
C2 Extraction:
rcam17.tuktuk.ug:11290
Unpacked files
SH256 hash:
61be7ea9d14564763b12dd83b341900ddaf18948ecc450141301dfc25329709d
MD5 hash:
6306b66fbf87dd2f3aa4c8953debb15c
SHA1 hash:
d792edf0433648c63ea2f2108e1c7bb7fa2eab91
Link:
https://www.unpac.me/results/7a21b9ac-3c34-4fd1-bc03-5e2f91317066/
SH256 hash:
cf0fdb9772a2e6699c10139432aa44d898d8eae9ff5951b4c28bda479703fa87
MD5 hash:
4984edb8382398b23a79904e123f87c8
SHA1 hash:
b5bb0c05dce85f6e4f8f555c2fac286a9275e88f
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/7a21b9ac-3c34-4fd1-bc03-5e2f91317066/
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/7a21b9ac-3c34-4fd1-bc03-5e2f91317066/
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/7a21b9ac-3c34-4fd1-bc03-5e2f91317066/
SH256 hash:
8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c
MD5 hash:
623bca798c05a1e5dc5a26ff57329459
SHA1 hash:
5d3db9376a7581fad4db73b87bcf6ce555e6138b
Link:
https://www.unpac.me/results/7a21b9ac-3c34-4fd1-bc03-5e2f91317066/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8b11bff6246c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8b11bff6246c53c7a2488b7375ce50a193a3e7a01e1f9bd4856bc55d90fb9e7c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/422819/
  
URLhaus
https://urlhaus.abuse.ch/url/2681321/

Comments


Avatar
zbet commented on 2023-07-17 16:49:10 UTC

url : hxxp://45.66.230.149/offer/updEdge.exe