MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea
SHA3-384 hash: 85849eaa04514bd387c49dfa5c6ee9ebcac3d4d475ddeefda627ca0ef10870c1df0caaa18084755cfa0dd7f4a78c98b2
SHA1 hash: 5599049de174188f8772efe6e39625a108646d9b
MD5 hash: 4f9119c67f24d0a2b214db019aafade2
humanhash: speaker-nuts-happy-yellow
File name:4f9119c67f24d0a2b214db019aafade2
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:698'000 bytes
First seen:2022-04-01 14:40:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a007107f22bc0ed186791cc35f469484 (1 x RedLineStealer)
ssdeep 12288:OrBKP5pPz0YaKv/LAzV2WiOEo956U3E0ElOMBzg1iiOwPKLEbRdYOvSMFjd7RX31:+BYzyyjAzQWIo95F0pfBzg1NOpE9dYO9
Threatray 1'143 similar samples on MalwareBazaar
TLSH T19FE423A6FB55D42BC40E2A76A553F45A2BBAFE126A214B071F61F81DCE313813CC781D
File icon (PE):PE icon
dhash icon d3d4d45133d4d433 (1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer signed

Code Signing Certificate

Organisation:Lenovo ThinkCentre X81 12DT003FUC
Issuer:Lenovo ThinkCentre X81 12DT003FUC
Algorithm:sha1WithRSAEncryption
Valid from:2022-03-31T14:03:55Z
Valid to:2032-04-01T14:03:55Z
Serial number: 4eae5aa429c649bc42d73bdf2caaf0bf
Intelligence: 7 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: d9a23afe5955be86c75361c006945ef243a2b7957bb5d3829f76dc58c282531c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://mastercracked.com/auslogics-boostspeed-premium-crack/
Verdict:
Malicious activity
Analysis date:
2022-04-02 13:21:45 UTC
Tags:
trojan rat redline evasion opendir loader stealer socelars vidar danabot
Link:
https://app.any.run/tasks/fb6ad19d-0c8c-4e49-8abf-a5c5821d2763

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Jaik.54214.14521.24672.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Launching a process
Changing a file
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
shell32.dll
Link:
https://www.filescan.io/uploads/62470ec71f20423948655f97/reports/e183b2d0-eed7-43d6-ae74-6201c1775e9b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ebd5bff3-757c-45d3-986e-1d153c91451f
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/969084
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Performs DNS queries to domains with low reputation
Sigma detected: File Created with System Process Name
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 601573 Sample: V0T6A5FI9C Startdate: 01/04/2022 Architecture: WINDOWS Score: 100 51 api.ip.sb 2->51 71 Multi AV Scanner detection for submitted file 2->71 73 Yara detected RedLine Stealer 2->73 75 .NET source code contains method to dynamically call methods (often used by packers) 2->75 77 4 other signatures 2->77 7 V0T6A5FI9C.exe 8 2->7         started        12 dllhost.exe 2->12         started        14 dllhost.exe 2->14         started        signatures3 process4 dnsIp5 53 zonasertaneja.com.br 50.116.86.44, 49760, 49761, 49762 UNIFIEDLAYER-AS-1US United States 7->53 55 blackhk1.beget.tech 5.101.153.227, 49759, 80 BEGET-ASRU Russian Federation 7->55 29 C:\Users\user\AppData\Local\Temp\KDCCE.exe, PE32 7->29 dropped 31 C:\Users\user\AppData\Local\Temp\IJ248.exe, PE32 7->31 dropped 33 C:\Users\user\AppData\...behaviorgraph0HD0JFKA297DH9.exe, PE32+ 7->33 dropped 35 3 other files (2 malicious) 7->35 dropped 79 Detected unpacking (changes PE section rights) 7->79 81 Creates HTML files with .exe extension (expired dropper behavior) 7->81 83 Tries to evade debugger and weak emulator (self modifying code) 7->83 16 KDCCE.exe 4 7->16         started        21 IJ248.exe 14 4 7->21         started        23 C09A8.exe 14 2 7->23         started        25 4 other processes 7->25 85 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->85 87 Machine Learning detection for dropped file 12->87 89 Hides threads from debuggers 12->89 file6 signatures7 process8 dnsIp9 37 yandex.ru 5.255.255.88, 443, 49774, 49776 YANDEXRU Russian Federation 16->37 27 C:\Users\user\AppData\Roaming\...\dllhost.exe, PE32 16->27 dropped 57 Detected unpacking (changes PE section rights) 16->57 59 Machine Learning detection for dropped file 16->59 61 Tries to evade debugger and weak emulator (self modifying code) 16->61 39 193.150.103.38, 49789, 80 ASGENERALTELRU Russian Federation 21->39 41 192.168.2.1 unknown unknown 21->41 43 api.ip.sb 21->43 63 Hides threads from debuggers 21->63 65 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 21->65 45 gumishosaled.xyz 185.45.192.228, 49791, 80 HSAE United Arab Emirates 23->45 67 Performs DNS queries to domains with low reputation 23->67 47 185.215.113.20, 21921, 49799 WHOLESALECONNECTIONSNL Portugal 25->47 49 iplogger.org 148.251.234.83, 443, 49797 HETZNER-ASDE Germany 25->49 69 May check the online IP address of the machine 25->69 file10 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-04-01 14:40:11 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s6fqymxeyw4gv6aqljc2konxpq75gdg56u4un3tag5uq3rxxcxva._file
Verdict:
malicious
Similar samples:
035135ef9ff11b79d5904a8ea08a1a430e6d9ca3d75bb30c0bd47d0f72486153
RedLineStealer
0d39fdc74c89e90f5952fc1352a22d9c1ed239453e5f6d98805aaeeedbce3022
RedLineStealer
26561f10cc120df745a1bbb4062af13aaf13129002ca36de757d11764849194f
RedLineStealer
2a0ceaf5ac0039a9409b47ebbe01ba3872726a6b6318bd697b8199396df49301
RedLineStealer
3d616db3bac20e1f2aeb4aa9ad6c53a64fb2ae692ddd4dfbca34e7552a772c13
RedLineStealer
56633dbf1eb43f772795a409d8bba5a5dc1e21ca111af731166dcb4fdab66ea9
RedLineStealer
5df70b6d4395c363a2f97843733996bceabfc71a9b30f6ef7361161b34b45bc6
RedLineStealer
957f1fe678da9b87111beb0ee535f17afbd288d76b0214f4fa8322c3fa27d878
RedLineStealer
d23a3aae9a1c5b8d5502b108856f0360a4af56c79fe421ca9125ba6bc259420d
RedLineStealer
f4ca00a988875fb8a01beeadd538610519b23866d0f16d27bb1c7e647d7a5a47
RedLineStealer
+ 1'133 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/220401-r1vscache7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea
MD5 hash:
4f9119c67f24d0a2b214db019aafade2
SHA1 hash:
5599049de174188f8772efe6e39625a108646d9b
Link:
https://www.unpac.me/results/bf918e78-5485-41b5-a98a-762d0d1c57d9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:PowerTool
Create hunting rule
Author:@bartblaze
Description:Identifies PowerTool, sometimes used by attackers to disable security software.
Reference:https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 978b0c32e4c5b86af8105a45a539b77c3fd30cddf53946ee6037690dc6f715ea

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2127017/

Comments


Avatar
zbet commented on 2022-04-01 14:40:09 UTC

url : hxxp://50.87.194.40/123/TrdngAnlzr1756.exe