MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91829e8014c4495c44af3cfec37018afd663e5ad58b6cce44ff36cf44044b4a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91829e8014c4495c44af3cfec37018afd663e5ad58b6cce44ff36cf44044b4a3
SHA3-384 hash: f5438d9e4d630c9b0077323cd91a1dee866af57035138cfb4a9a8cb6934e9b5aed6718f317f699cda32e4391c5ef60d5
SHA1 hash: fa4c39bbab33d3b7bb16fdc2366c239149d8c475
MD5 hash: d7b0929da8d096c120dc79fc2cf45f82
humanhash: six-crazy-eight-earth
File name:d7b0929da8d096c120dc79fc2cf45f82
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:64'000 bytes
First seen:2021-10-02 09:45:36 UTC
Last seen:2021-10-02 10:58:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 768:PGo6ClG4J+MEhVgCwXFdB7zBIuKiMmFG/+gRqqqWhJWz7OiMArAhBb5bb0ufT979:PiLhlw9XBkmaD/JW0bb0EUSg
Threatray 4 similar samples on MalwareBazaar
TLSH T10853B6BB416154A6C1882334F8751F0B367CD6351980B69CF04FB2AAEC1D69D8EF87B5
File icon (PE):PE icon
dhash icon a0cca491f8b02336 (1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d7b0929da8d096c120dc79fc2cf45f82
Verdict:
Malicious activity
Analysis date:
2021-10-02 09:48:46 UTC
Tags:
evasion stealer
Link:
https://app.any.run/tasks/761695d7-2091-4544-a209-ebd4e7d56978

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194174/
Detection(s):
SecuriteInfo.com.Trojan.Downloader.9452.13296.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Query of malicious DNS domain
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c01b4820-3709-498c-8d4a-27dd983f82da
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/863160
Signature
Detected unpacking (changes PE section rights)
Drops PE files with a suspicious file extension
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 495584 Sample: 4TRMVE86DC Startdate: 02/10/2021 Architecture: WINDOWS Score: 100 35 clientconfig.passport.net 2->35 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected RedLine Stealer 2->57 59 Found many strings related to Crypto-Wallets (likely being stolen) 2->59 61 2 other signatures 2->61 8 4TRMVE86DC.exe 15 5 2->8         started        13 WinHoster.exe 2 2->13         started        15 WinHoster.exe 2 2->15         started        signatures3 process4 dnsIp5 39 iplogger.org 88.99.66.31, 443, 49777, 49778 HETZNER-ASDE Germany 8->39 41 onepremiumstore.bar 172.67.214.80, 443, 49722, 49724 CLOUDFLARENETUS United States 8->41 43 auto-repair-solutions.bar 8->43 31 C:\Users\user\AppData\Roaming\8721215.scr, PE32 8->31 dropped 33 C:\Users\user\AppData\Roaming\4892733.scr, PE32 8->33 dropped 69 May check the online IP address of the machine 8->69 71 Drops PE files with a suspicious file extension 8->71 17 4892733.scr 1 4 8->17         started        21 8721215.scr 15 24 8->21         started        file6 signatures7 process8 dnsIp9 29 C:\Users\user\AppData\...\WinHoster.exe, PE32 17->29 dropped 45 Multi AV Scanner detection for dropped file 17->45 47 Detected unpacking (changes PE section rights) 17->47 49 Machine Learning detection for dropped file 17->49 24 WinHoster.exe 2 17->24         started        37 glitterandsparkle.net 172.67.201.11, 443, 49734 CLOUDFLARENETUS United States 21->37 51 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->51 53 Tries to harvest and steal browser information (history, passwords, etc) 21->53 27 conhost.exe 21->27         started        file10 signatures11 process12 signatures13 63 Multi AV Scanner detection for dropped file 24->63 65 Detected unpacking (changes PE section rights) 24->65 67 Machine Learning detection for dropped file 24->67
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91829e8014c4495c44af3cfec37018afd663e5ad58b6cce44ff36cf44044b4a3/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-10-02 09:46:55 UTC
AV detection:
14 of 45 (31.11%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
48f9b4bc2bf75c03449857ff0d6b47c35ab97ed8ba444890ccdd4128d9ae1027
RedLineStealer
6987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994
RedLineStealer
8fd4b32e8bc096e4f4c34ba302295caa4accd453edff3e4a153397710fbc4a94
RedLineStealer
c34f4d1ea21e7248fc8ba8679713d87d35d5f02ab8fc0cf14bed0f1e7eb87492
RedLineStealer
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence spyware stealer
Link:
https://tria.ge/reports/211002-lrmgqaebc3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
ccfac033f1c627ec6fd18d698329051178b88f362c837d425b10e7ebea709cfa
MD5 hash:
6757e0dc859f787c219c04cdd0be9398
SHA1 hash:
8f00349d6522978f9aa8b8bc74f009d6b408c1e7
Link:
https://www.unpac.me/results/d1b77dd6-6997-40ba-b787-cc04416a4bd8/
SH256 hash:
91829e8014c4495c44af3cfec37018afd663e5ad58b6cce44ff36cf44044b4a3
MD5 hash:
d7b0929da8d096c120dc79fc2cf45f82
SHA1 hash:
fa4c39bbab33d3b7bb16fdc2366c239149d8c475
Link:
https://www.unpac.me/results/d1b77dd6-6997-40ba-b787-cc04416a4bd8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/91829e8014c4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91829e8014c4495c44af3cfec37018afd663e5ad58b6cce44ff36cf44044b4a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 91829e8014c4495c44af3cfec37018afd663e5ad58b6cce44ff36cf44044b4a3

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194174/

Comments


Avatar
zbet commented on 2021-10-02 09:45:36 UTC

url : hxxps://www.marketingonline.com/21triggers/yanik/BsCleaner82Setp.exe