MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91e9ff830bee00ed634284c3d3706fbc7f9cdc3d377a5ff1bb9dfccfb37ca204. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91e9ff830bee00ed634284c3d3706fbc7f9cdc3d377a5ff1bb9dfccfb37ca204
SHA3-384 hash: 4a2bea611bd24594cd9df6acfc62653482fb2c21f952f92a31c43d6625c20dab8bbd6ad900346aa2ed658f2ed87a86a6
SHA1 hash: e6ff443247b43f08431671503acc4e626e08a915
MD5 hash: 2d36224d4749e41414d4664b2d6ee538
humanhash: aspen-black-triple-london
File name:sutup.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'230'640 bytes
First seen:2022-07-28 19:43:55 UTC
Last seen:2022-07-28 19:43:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e33718404ffbe0d91b536c10bf053f8 (80 x RedLineStealer, 7 x RecordBreaker, 4 x N-W0rm)
ssdeep 24576:VQUTIhVUzIeFuDqSbYFY4RrhmB+iMyYdaHaLGEa1oS2TQlGT9GGaja+R:V9WSzISuDnr8KkSDQGja+R
TLSH T110455C2AE70615B8DA5357B1C59EFA7B9B147A248032AE3FFF4ADA0CB4331133C85156
TrID 44.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
23.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.4% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
354
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/294975/
Detection(s):
Win.Packed.Generic-9958634-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/27705/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/61674bcf-c4d3-4d5b-b61d-456ddc3ad08d
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1042736
Signature
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91e9ff830bee00ed634284c3d3706fbc7f9cdc3d377a5ff1bb9dfccfb37ca204/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-07-28 19:44:09 UTC
File Type:
PE (Exe)
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=shu77ayl5yao2y2cqtb5g4dpxr7zzxb5g55f74n3tx6m7m34uica._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline infostealer spyware
Link:
https://tria.ge/reports/220728-yfs7caaeg7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
RedLine
RedLine payload
Malware Config
C2 Extraction:
185.215.113.23:15912
Unpacked files
SH256 hash:
104f37f318c86c0b4c570a019b5a273aa36a97d311c472ce73b812b793694f51
MD5 hash:
98a10834dc975968523feb52aa58d4eb
SHA1 hash:
71deb4d78d225f0abb7c149debe567aa91209216
Link:
https://www.unpac.me/results/539923da-16b8-41d6-880e-23a6200f12dc/
SH256 hash:
91e9ff830bee00ed634284c3d3706fbc7f9cdc3d377a5ff1bb9dfccfb37ca204
MD5 hash:
2d36224d4749e41414d4664b2d6ee538
SHA1 hash:
e6ff443247b43f08431671503acc4e626e08a915
Link:
https://www.unpac.me/results/539923da-16b8-41d6-880e-23a6200f12dc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/91e9ff830bee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 91e9ff830bee00ed634284c3d3706fbc7f9cdc3d377a5ff1bb9dfccfb37ca204

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/294975/

Comments