MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536
SHA3-384 hash: 977fde4a4687cbfd07ba97f14dda1bf10b3140bc96f7586438fb22d9a574f409530d1d40271f87f83c5c8d97a8c8ada3
SHA1 hash: 18939578f0195599b86c01696f788186b51cac5d
MD5 hash: 1845a85e4e3e55494437d73306363b6b
humanhash: idaho-crazy-friend-hawaii
File name:1845a85e4e3e55494437d73306363b6b.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'390'504 bytes
First seen:2023-03-12 23:40:25 UTC
Last seen:2023-03-13 01:28:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash db00bc6cb1460fee2c49d106d7b852bd (2 x RedLineStealer)
ssdeep 24576:ncq4uHP95wifz5+FSbWp1EACAXVn/rrtN1d5OZwAoZSvv6XqXUDDc0Q5+:cSJb5+VWVKVnDrJrOOLIvv66EPc0Q5+
Threatray 2'330 similar samples on MalwareBazaar
TLSH T14455AFA8F865C382EA76F3B9051FD0FADC15903BEDF04812B93187BA36D99D3D0116A5
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon cf2b592579756b0c (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:autodiscover.makarov.com
Issuer:R3
Algorithm:sha256WithRSAEncryption
Valid from:2023-01-19T12:09:32Z
Valid to:2023-04-19T12:09:31Z
Serial number: 031b5f428d0d6eb795c10b3a1a4e15858d14
Thumbprint Algorithm:SHA256
Thumbprint: 913eca346d7a3f6475b08c54d7c364e4cfd07a38bcdd0d388158592375855e29
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
RedLineStealer C2:
178.132.2.56:1615

Intelligence

File Origin
# of uploads :
2
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1845a85e4e3e55494437d73306363b6b.exe
Verdict:
No threats detected
Analysis date:
2023-03-12 23:43:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ad267c09-df67-4dc9-bf1f-1e3a1d0c8ba2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/373835/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65763208.24469.24101.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Launching a process
Creating a file in the %temp% directory
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Сreating synchronization primitives
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/72885/overview
Behaviour
MalwareBazaar
CallSleep
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed redline
Link:
https://www.filescan.io/uploads/640e630f86958b4d2a274928/reports/1314f786-22c7-4aba-96e0-25412d51320a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dad129ab-d683-47b6-9d53-143b0df7d168
Result
Threat name:
RHADAMANTHYS, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1192154
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected RedLine Stealer
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 825030 Sample: zOcUUDReSx.exe Startdate: 13/03/2023 Architecture: WINDOWS Score: 100 25 Snort IDS alert for network traffic 2->25 27 Malicious sample detected (through community Yara rule) 2->27 29 Multi AV Scanner detection for dropped file 2->29 31 8 other signatures 2->31 6 zOcUUDReSx.exe 7 2->6         started        process3 dnsIp4 19 youpyfhe5t33mrdpuycslsu44.wki2gyqebqh3piqhfsci1l1mv7o3xgu 6->19 17 C:\Users\user\AppData\Local\...\4792593.dll, PE32 6->17 dropped 33 Writes to foreign memory regions 6->33 35 Allocates memory in foreign processes 6->35 37 Injects a PE file into a foreign processes 6->37 11 fontview.exe 6->11         started        15 ngentask.exe 4 6->15         started        file5 signatures6 process7 dnsIp8 21 109.206.243.168, 80 AWMLTNL Germany 11->21 39 Query firmware table information (likely to detect VMs) 11->39 41 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 11->41 43 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->43 53 4 other signatures 11->53 23 178.132.2.56, 1615, 49701 WORLDSTREAMNL Netherlands 15->23 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->45 47 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->47 49 Tries to harvest and steal browser information (history, passwords, etc) 15->49 51 Tries to steal Crypto Currency Wallets 15->51 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-02-18 13:22:00 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
22 of 39 (56.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ug5nlbkvuvx3lozhal6oqnzzvhrswfspemq72pvzw7mk4jxg2u3a._file
Verdict:
malicious
Similar samples:
07ef3c17f83a7edd9e2c820c10d1b24bb21804a734a1d6e6de9d9bcf1e9426e1
RedLineStealer
2a685c2c017b83205b89036e550e0161d3fe4e7e6e9f48ae2306d53a1df626e6
RedLineStealer
3a156d1223d2420acadac6e2b8e9f27c4724515b4bf456fd34b4ad3aff36a8c4
RedLineStealer
50625ef66704390804940dfe1e9b09003723f99bd109ff262757de3aa1b82cc9
RedLineStealer
777e70135321f3b5f6e8402192ee653b21e789fbd505c1b95fa643ce4a140689
RedLineStealer
8e8e80c232d932d12eeb034bab164f7f97c01c522aaceee272b2931e8fbd5653
RedLineStealer
d86c70788e8597af95906106bb03ed111f0c3eb5a359dd93b6a0d7a3fdf9c3cc
RedLineStealer
f92b81ca5eebd6f7fb97f0c94d92874c97d738db54887421b82cade3a4be90cd
RedLineStealer
+ 2'320 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:redline family:rhadamanthys botnet:rozena infostealer spyware stealer
Link:
https://tria.ge/reports/230312-3pegrsfh23/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Detect rhadamanthys stealer shellcode
RedLine
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
178.132.2.56:1615
Unpacked files
SH256 hash:
fbff7b0f20306720a97f006e9095edabf452dea2fd3ee5ec5f9d0bf712eae930
MD5 hash:
b0dabfed00c673d2b8aff6ce66513b36
SHA1 hash:
fdb56699cccb60e94710d04514a1cb84d35e39f5
Link:
https://www.unpac.me/results/de730ebb-0c43-4f5d-86a8-80cc8f45e770/
SH256 hash:
a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536
MD5 hash:
1845a85e4e3e55494437d73306363b6b
SHA1 hash:
18939578f0195599b86c01696f788186b51cac5d
Link:
https://www.unpac.me/results/de730ebb-0c43-4f5d-86a8-80cc8f45e770/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a1bad58555a5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.27
Link:
https://yomi.yoroi.company/submissions/a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/373835/

Comments