MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f38a8b1fc30c406eeb6877e201fb46b465954da4c356dea81b29d804c96712e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f38a8b1fc30c406eeb6877e201fb46b465954da4c356dea81b29d804c96712e
SHA3-384 hash: 34092cceb8f0354ca770497cdf335524e98513b1341bbb1c84026803c769cec324d25dfd3542669b8bc2d03a8ca30c49
SHA1 hash: 2010ae8ed9a695aa70648413f109655176db5968
MD5 hash: 9f516819ee3619fdbbb6636b1b8a0462
humanhash: nuts-failed-kansas-papa
File name:9F516819EE3619FDBBB6636B1B8A0462.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:188'416 bytes
First seen:2021-08-16 00:20:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf5a4aa99e5b160f8521cadd6bfe73b8 (434 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep 3072:SDKW1LgppLRHMY0TBfJvjcTp5X5NArT0Xj+PRusWC:SDKW1Lgbdl0TBBvjc/5NArTGj+5usj
Threatray 952 similar samples on MalwareBazaar
TLSH T1A504AE1175C1C1B3C4B7113045E6CB799A7A3072076A95E7BBDD1BBA6E203E1A3362CE
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
91.142.79.35:13400

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.142.79.35:13400 https://threatfox.abuse.ch/ioc/189289/

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9F516819EE3619FDBBB6636B1B8A0462.exe
Verdict:
Malicious activity
Analysis date:
2021-08-16 00:26:45 UTC
Tags:
trojan rat redline stealer
Link:
https://app.any.run/tasks/464fdf56-fc89-4afc-9352-60f3cb63157e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/179399/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a window
Creating a process from a recently created file
Creating a file
Creating a process with a hidden window
Running batch commands
Launching a process
Sending a UDP request
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5b105e0a-e60b-422e-acce-c607f0d45e73
Result
Threat name:
Amadey RedLine
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/833263
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many IPs within the same subnet mask (likely port scanning)
Contains functionality to inject code into remote processes
Creates an undocumented autostart registry key
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Amadey bot
Yara detected Amadeys stealer DLL
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 465694 Sample: onekb0XOFQ.exe Startdate: 16/08/2021 Architecture: WINDOWS Score: 100 74 x-vpn.ug 2->74 102 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->102 104 Multi AV Scanner detection for domain / URL 2->104 106 Found malware configuration 2->106 108 18 other signatures 2->108 10 onekb0XOFQ.exe 15 32 2->10         started        15 drbux.exe 2->15         started        17 IntelRapid.exe 2->17         started        19 drbux.exe 2->19         started        signatures3 process4 dnsIp5 76 91.142.79.35, 13400, 49718, 49720 VTSL1-ASRU Russian Federation 10->76 78 api.ip.sb 10->78 80 cdn.discordapp.com 162.159.135.233, 443, 49722, 49730 CLOUDFLARENETUS United States 10->80 56 C:\Users\user\AppData\Local\Temp\a.exe, PE32 10->56 dropped 58 C:\Users\user\AppData\...\onekb0XOFQ.exe.log, ASCII 10->58 dropped 118 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->118 120 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 10->120 122 Tries to harvest and steal browser information (history, passwords, etc) 10->122 124 Tries to steal Crypto Currency Wallets 10->124 21 a.exe 4 10->21         started        25 conhost.exe 10->25         started        file6 signatures7 process8 file9 54 C:\Users\user\AppData\Local\...\drbux.exe, PE32 21->54 dropped 110 Multi AV Scanner detection for dropped file 21->110 112 Detected unpacking (changes PE section rights) 21->112 114 Detected unpacking (overwrites its own PE header) 21->114 116 2 other signatures 21->116 27 drbux.exe 27 21->27         started        signatures10 process11 dnsIp12 82 x-vpn.ug 109.234.32.63, 49728, 49729, 49732 VDSINA-ASRU Russian Federation 27->82 84 cdn.discordapp.com 27->84 60 C:\Users\user\AppData\Local\Temp\client.exe, PE32 27->60 dropped 62 C:\Users\user\AppData\Local\Temp\Chrome.exe, PE32+ 27->62 dropped 64 C:\Users\user\AppData\Local\...\cred[1].dll, PE32 27->64 dropped 66 4 other malicious files 27->66 dropped 126 Multi AV Scanner detection for dropped file 27->126 128 Detected unpacking (changes PE section rights) 27->128 130 Detected unpacking (overwrites its own PE header) 27->130 132 2 other signatures 27->132 32 rundll32.exe 27->32         started        36 client.exe 27->36         started        39 cmd.exe 1 27->39         started        41 2 other processes 27->41 file13 signatures14 process15 dnsIp16 68 redteamminepool.ug 193.164.16.126, 49763, 80 AT-ASRU Russian Federation 32->68 70 192.168.2.3, 13400, 443, 49679 unknown unknown 32->70 86 System process connects to network (likely due to code injection or exploit) 32->86 88 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 32->88 90 Tries to steal Instant Messenger accounts or passwords 32->90 100 2 other signatures 32->100 52 C:\Users\user\AppData\...\IntelRapid.exe, PE32 36->52 dropped 92 Multi AV Scanner detection for dropped file 36->92 94 Detected unpacking (changes PE section rights) 36->94 96 Detected unpacking (overwrites its own PE header) 36->96 98 Machine Learning detection for dropped file 36->98 43 IntelRapid.exe 36->43         started        45 reg.exe 1 39->45         started        48 conhost.exe 39->48         started        72 192.168.2.1 unknown unknown 41->72 50 conhost.exe 41->50         started        file17 signatures18 process19 signatures20 134 Creates an undocumented autostart registry key 45->134
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f38a8b1fc30c406eeb6877e201fb46b465954da4c356dea81b29d804c96712e/
Threat name:
Win32.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-08-15 18:53:00 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r44krmp4gdcan3vwq57cah5unndfsvg2jq2w32ubwkoyatewoexa._file
Verdict:
malicious
Similar samples:
4194b8d83f6a72469c75a45c7fcfae079989a6883c9dd7dc124d800c57f6fe54
RedLineStealer
4db35ea029c5e2d5073018bed89c24b0c4e54b831ff6d5ddf0e370b6289d3631
RedLineStealer
6bd20157eb146f12887ccb49fa09ac5b0c817983edc43ca1b665f17ad3ebfb25
RedLineStealer
7ac85575a5601ad9b71531eb84ada81207d07b29d8fe2e949d56222bd1594135
RedLineStealer
884a1949638e54c76eb0ee548d3a23b4ecf29aba47408564d379fb2dc6cdef92
RedLineStealer
8babde64a6d3b85c2c4315205ae58884ee01f6364477a777f09d5b9c3ceef2a6
RedLineStealer
a1b0074cbd56956cc94e6161361f8f7407075f2903d14d082c1006f411bec90a
RedLineStealer
b94a2a3b2f0f5de3a222f3efbcd52fac565f4d97069ec19fdcaeba676374558b
RedLineStealer
+ 942 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:redline botnet:1582235610 discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/210816-9p9lktxqze/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Amadey
RedLine
RedLine Payload
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
91.142.79.35:13400
x-vpn.ug/hfV3vDtt/index.php
Unpacked files
SH256 hash:
1826f8c3b0f5bb7becb1f8e5929c644f609224155355a23a83d05428667f6cc0
MD5 hash:
325fa4bfe4bbc391d644061de5d6e8d4
SHA1 hash:
85e6925d829ea70f083b257301b56387e447b0e1
Link:
https://www.unpac.me/results/eb6b1313-5ed8-43c6-947c-b9c03cbe9a01/
SH256 hash:
7ddda3548c54a6feb42e04e5740b5a6a61175a03d0556ac5d8bb929706b5164e
MD5 hash:
9730df37ce8523fcbf769e61a66362b2
SHA1 hash:
7be4b083e17afac9ab7e78f2a751d5e8775bdba6
Link:
https://www.unpac.me/results/eb6b1313-5ed8-43c6-947c-b9c03cbe9a01/
SH256 hash:
8f38a8b1fc30c406eeb6877e201fb46b465954da4c356dea81b29d804c96712e
MD5 hash:
9f516819ee3619fdbbb6636b1b8a0462
SHA1 hash:
2010ae8ed9a695aa70648413f109655176db5968
Link:
https://www.unpac.me/results/eb6b1313-5ed8-43c6-947c-b9c03cbe9a01/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8f38a8b1fc30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f38a8b1fc30c406eeb6877e201fb46b465954da4c356dea81b29d804c96712e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/179399/

Comments