MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3
SHA3-384 hash: f400287c6f20dfb32e8af9d4e2d4dbf0385d4cc00954aeeeb169249c2868f6982ea7f784368cc715eadbdbafc5372b7b
SHA1 hash: 23f3da23bcbec0ba7e206e89b2fa00bd6fbc1359
MD5 hash: 2b6f6b38ea91c530c9cc18e4fcdc8356
humanhash: speaker-two-steak-nine
File name:2b6f6b38ea91c530c9cc18e4fcdc8356
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'060'104 bytes
First seen:2022-02-05 15:49:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ceu/oxV0MVPC52fjFiFnzQfiRTXXYRXnjByushCxZ9jgp4zz:c/gY2fsnzKRqM5X
Threatray 60 similar samples on MalwareBazaar
TLSH T13435E8DD51C59849CDEE27F01DFBA88CAD7094DA938773EAA32C95F0AB423C2654D4E0
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2b6f6b38ea91c530c9cc18e4fcdc8356
Verdict:
Malicious activity
Analysis date:
2022-02-05 16:02:13 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/bb3fd682-bd32-485d-b5b9-bf4a83fd7f6f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/233597/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.31811.13540.30489.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Reading critical registry keys
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed packed
Link:
https://www.filescan.io/uploads/61fe9cb5a72f86da695e2e8d/reports/5e41a88b-dc02-475f-9606-37d663019841/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d320055e-966f-465a-8d97-afb00bbaba22
Result
Threat name:
BitCoin Miner Clipboard Hijacker RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/934506
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Found evasive API chain (may stop execution after checking mutex)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected Clipboard Hijacker
Yara detected RedLine Stealer
Yara detected SilentXMRMiner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 566984 Sample: 0iBKuwOi0D Startdate: 05/02/2022 Architecture: WINDOWS Score: 100 99 Malicious sample detected (through community Yara rule) 2->99 101 Antivirus detection for URL or domain 2->101 103 Antivirus / Scanner detection for submitted sample 2->103 105 7 other signatures 2->105 13 0iBKuwOi0D.exe 3 2->13         started        17 services32.exe 2->17         started        19 oobeldr.exe 2->19         started        process3 file4 79 C:\Users\user\AppData\...\0iBKuwOi0D.exe.log, ASCII 13->79 dropped 121 Writes to foreign memory regions 13->121 123 Injects a PE file into a foreign processes 13->123 21 RegAsm.exe 15 9 13->21         started        125 Antivirus detection for dropped file 17->125 127 Multi AV Scanner detection for dropped file 17->127 129 Allocates memory in foreign processes 17->129 131 Creates a thread in another existing process (thread injection) 17->131 26 conhost.exe 2 17->26         started        133 Found evasive API chain (may stop execution after checking mutex) 19->133 135 Contains functionality to compare user and computer (likely to detect sandboxes) 19->135 28 schtasks.exe 1 19->28         started        signatures5 process6 dnsIp7 85 c9d0e790b353537889bd47a364f5acff43c11f2414.xyz 185.112.83.122, 49808, 80 SUPERSERVERSDATACENTERRU Russian Federation 21->85 87 5.206.227.11, 49828, 63730 DOTSIPT Portugal 21->87 89 10 other IPs or domains 21->89 71 C:\Users\user\AppData\Roaming\e3dwefw.exe, PE32 21->71 dropped 73 C:\Users\user\AppData\Roaming\asf3r3.exe, PE32 21->73 dropped 75 C:\Users\user\AppData\Roaming\asd3wwfd.exe, PE32+ 21->75 dropped 113 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->113 115 Performs DNS queries to domains with low reputation 21->115 117 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->117 119 Tries to harvest and steal browser information (history, passwords, etc) 21->119 30 asd3wwfd.exe 21->30         started        33 e3dwefw.exe 1 21->33         started        36 asf3r3.exe 2 21->36         started        39 conhost.exe 28->39         started        file8 signatures9 process10 dnsIp11 137 Antivirus detection for dropped file 30->137 139 Multi AV Scanner detection for dropped file 30->139 141 Writes to foreign memory regions 30->141 149 2 other signatures 30->149 41 conhost.exe 4 30->41         started        69 C:\Users\user\AppData\Roaming\...\oobeldr.exe, PE32 33->69 dropped 143 Uses schtasks.exe or at.exe to add and modify task schedules 33->143 145 Contains functionality to compare user and computer (likely to detect sandboxes) 33->145 44 schtasks.exe 1 33->44         started        83 46.3.197.208, 18570, 49854, 49855 ALEXHOST_SRLMD Russian Federation 36->83 147 Machine Learning detection for dropped file 36->147 file12 signatures13 process14 file15 77 C:\Users\user\AppData\...\services32.exe, PE32+ 41->77 dropped 46 cmd.exe 1 41->46         started        48 cmd.exe 1 41->48         started        50 conhost.exe 44->50         started        process16 process17 52 services32.exe 46->52         started        55 conhost.exe 46->55         started        57 conhost.exe 48->57         started        59 schtasks.exe 1 48->59         started        signatures18 107 Writes to foreign memory regions 52->107 109 Allocates memory in foreign processes 52->109 111 Creates a thread in another existing process (thread injection) 52->111 61 conhost.exe 5 52->61         started        process19 file20 81 C:\Users\user\AppData\...\sihost32.exe, PE32+ 61->81 dropped 64 sihost32.exe 61->64         started        process21 signatures22 91 Antivirus detection for dropped file 64->91 93 Multi AV Scanner detection for dropped file 64->93 95 Writes to foreign memory regions 64->95 97 2 other signatures 64->97 67 conhost.exe 64->67         started        process23
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-05 15:50:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 43 (46.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r4skwyez5c4hqiwsnrh2xhtnn4yi3sxs2sdonzi4vv2hul55oxbq._file
Verdict:
malicious
Similar samples:
044c4e0f1bc9b09ac252d12645a9c38a549944688609dacd3960cb0652314983
RedLineStealer
1ed5934c95292cf6d732ae068e1ef5e5c057088b199031e8be45eaf26a475c67
RedLineStealer
70abd0e56d64c9d19e81fc1f62f09b9644b00819c5a1feccfd185c168f4a2099
RedLineStealer
773b40c8007545afd1b563bdf17dab8225acd4bd6def35e4db95f70fca16371c
RedLineStealer
973294652225d5fa7ed66a39c2c0b1ef2b518169f1300ca0109c61cde55d35f1
RedLineStealer
b2a5b282b91df9293450c3570495800cab173545524fed91e3f32e732ebd012e
RedLineStealer
d29acdeb134477223baaf3b97aef34f5ff2b5832567718025bdac30421ac7ad7
RedLineStealer
d3cfc436366c9d127c7a6233f6531cf6e5863153b41ba4ab6f8fe87f473c8c9d
RedLineStealer
dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84
RedLineStealer
+ 50 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220205-s9y2ssdbfn/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
5.206.227.11:63730
Unpacked files
SH256 hash:
f579e7bba593fef524d860d93a76b74964b1c771d1594c5e70e2782c0beb9bf0
MD5 hash:
f51bf49eb9b5f0b881ac8f9a15f1d9c5
SHA1 hash:
c3a602357195331d1b714c3ef93653bf229bbb3e
Link:
https://www.unpac.me/results/d3081e6c-a7f8-4f55-912b-0dd8336e46ca/
SH256 hash:
8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3
MD5 hash:
2b6f6b38ea91c530c9cc18e4fcdc8356
SHA1 hash:
23f3da23bcbec0ba7e206e89b2fa00bd6fbc1359
Link:
https://www.unpac.me/results/d3081e6c-a7f8-4f55-912b-0dd8336e46ca/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8f24ab6099e8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/233597/
  
URLhaus
https://urlhaus.abuse.ch/url/2030954/

Comments


Avatar
zbet commented on 2022-02-05 15:49:29 UTC

url : hxxp://195.140.147.188/files/F1yDi/F1yDi_2.exe