MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878
SHA3-384 hash: 15c066ef6a984c3a5925f9352b16ce2538d21f250c7c650ad9240cab30d4e9e60e7e985f074e2f53f32e8602e3bdb427
SHA1 hash: 5c21d54aa545dc28880fdb266aea7021405a7b1f
MD5 hash: 8bf37da991437c5e024b4c342b0d687e
humanhash: pasta-purple-zulu-uncle
File name:8bf37da991437c5e024b4c342b0d687e
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:698'384 bytes
First seen:2022-04-01 14:39:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 169e59e39d2e3a4161f73e954c50c5d1 (1 x RedLineStealer)
ssdeep 12288:ArBK3Q1jZZBilZD3zsRf1bSTEhX54kAhQ9JNbbBxdhVGOT+3WEhirBHdeuYayYuX:QBx1VZEiRf1RhXZAuzbBLHbrRM0MX
Threatray 1'123 similar samples on MalwareBazaar
TLSH T12FE422779B55CC6BE8690A321F93FE205A2ADF953C150F1B6E22B84D8DB537D3C001A9
File icon (PE):PE icon
dhash icon 9e33b0f2f2cc84e4 (1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer signed

Code Signing Certificate

Organisation:Lenovo ThinkCentre X81 12DT003FUC
Issuer:Lenovo ThinkCentre X81 12DT003FUC
Algorithm:sha1WithRSAEncryption
Valid from:2022-03-31T14:03:55Z
Valid to:2032-04-01T14:03:55Z
Serial number: 4eae5aa429c649bc42d73bdf2caaf0bf
Intelligence: 7 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: d9a23afe5955be86c75361c006945ef243a2b7957bb5d3829f76dc58c282531c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.54214.25671.26729.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Launching a process
Changing a file
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/62470ec4a19c649412b993b9/reports/5879377e-b772-489a-bdad-b23cce8350e5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3267b84-bd8c-4070-a125-e0891dc1fa3b
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/969088
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Sigma detected: File Created with System Process Name
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 601576 Sample: J1iP4zusHy Startdate: 01/04/2022 Architecture: WINDOWS Score: 100 51 api.ip.sb 2->51 69 Multi AV Scanner detection for submitted file 2->69 71 Yara detected RedLine Stealer 2->71 73 .NET source code contains method to dynamically call methods (often used by packers) 2->73 75 3 other signatures 2->75 7 J1iP4zusHy.exe 8 2->7         started        12 dllhost.exe 2->12         started        14 dllhost.exe 2->14         started        signatures3 process4 dnsIp5 53 zonasertaneja.com.br 50.116.86.44, 49756, 49768, 49775 UNIFIEDLAYER-AS-1US United States 7->53 55 blackhk1.beget.tech 5.101.153.227, 49755, 80 BEGET-ASRU Russian Federation 7->55 29 C:\Users\user\AppData\...\H3L386G28H75J19.exe, PE32+ 7->29 dropped 31 C:\Users\user\AppData\Local\Temp\CG76F.exe, PE32 7->31 dropped 33 C:\Users\user\AppData\Local\Temp\8E1I3.exe, PE32 7->33 dropped 35 3 other files (2 malicious) 7->35 dropped 77 Detected unpacking (changes PE section rights) 7->77 79 Creates HTML files with .exe extension (expired dropper behavior) 7->79 81 Tries to evade debugger and weak emulator (self modifying code) 7->81 16 17D32.exe 4 7->16         started        21 CG76F.exe 2 7->21         started        23 8E1I3.exe 14 4 7->23         started        25 4 other processes 7->25 83 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->83 85 Machine Learning detection for dropped file 12->85 87 Hides threads from debuggers 12->87 file6 signatures7 process8 dnsIp9 37 yandex.ru 5.255.255.88, 443, 49789, 49791 YANDEXRU Russian Federation 16->37 27 C:\Users\user\AppData\Roaming\...\dllhost.exe, PE32 16->27 dropped 57 Detected unpacking (changes PE section rights) 16->57 59 Machine Learning detection for dropped file 16->59 61 Tries to evade debugger and weak emulator (self modifying code) 16->61 39 gumishosaled.xyz 185.45.192.228, 49801, 80 HSAE United Arab Emirates 21->39 63 Performs DNS queries to domains with low reputation 21->63 65 Hides threads from debuggers 21->65 41 193.150.103.38, 49797, 80 ASGENERALTELRU Russian Federation 23->41 43 192.168.2.1 unknown unknown 23->43 45 api.ip.sb 23->45 47 185.215.113.20, 21921, 49799 WHOLESALECONNECTIONSNL Portugal 25->47 49 iplogger.org 148.251.234.83, 443, 49800 HETZNER-ASDE Germany 25->49 67 May check the online IP address of the machine 25->67 file10 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878/
Threat name:
Win32.Trojan.Jaik
Create hunting rule
Status:
Malicious
First seen:
2022-04-01 14:40:11 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sv7r7zty3knyoei35mhoknprpl55fcgxnmbbj5h2qmrmh6rh3b4a._file
Verdict:
malicious
Similar samples:
035135ef9ff11b79d5904a8ea08a1a430e6d9ca3d75bb30c0bd47d0f72486153
RedLineStealer
0d39fdc74c89e90f5952fc1352a22d9c1ed239453e5f6d98805aaeeedbce3022
RedLineStealer
26561f10cc120df745a1bbb4062af13aaf13129002ca36de757d11764849194f
RedLineStealer
2a0ceaf5ac0039a9409b47ebbe01ba3872726a6b6318bd697b8199396df49301
RedLineStealer
3c3bf835742e7a36b7a7c7866965e351077c08c48479f2cd988133bf65f22cef
RedLineStealer
3d616db3bac20e1f2aeb4aa9ad6c53a64fb2ae692ddd4dfbca34e7552a772c13
RedLineStealer
56633dbf1eb43f772795a409d8bba5a5dc1e21ca111af731166dcb4fdab66ea9
RedLineStealer
5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6
RedLineStealer
d23a3aae9a1c5b8d5502b108856f0360a4af56c79fe421ca9125ba6bc259420d
RedLineStealer
f4ca00a988875fb8a01beeadd538610519b23866d0f16d27bb1c7e647d7a5a47
RedLineStealer
+ 1'113 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/220401-r1vscache6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878
MD5 hash:
8bf37da991437c5e024b4c342b0d687e
SHA1 hash:
5c21d54aa545dc28880fdb266aea7021405a7b1f
Link:
https://www.unpac.me/results/a5270551-6ce2-4703-bcc1-30adacbc7b56/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:PowerTool
Create hunting rule
Author:@bartblaze
Description:Identifies PowerTool, sometimes used by attackers to disable security software.
Reference:https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2127020/

Comments


Avatar
zbet commented on 2022-04-01 14:39:25 UTC

url : hxxp://50.87.194.40/123/TR15Setup.exe