MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a23c3c4409f2674964a29f8cee7a95834440c94225cfaa915d342edd1896ea30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a23c3c4409f2674964a29f8cee7a95834440c94225cfaa915d342edd1896ea30
SHA3-384 hash: 5df11a4d1096d295194cee0ab83fb3eb4abb64498735cf333d2a191f2b3f97086b98e27e77db8c34f4db9d31d67f5d5f
SHA1 hash: eb8ecb2c3d7f509d050be27da8d7636eed649bef
MD5 hash: 2751a07a258d21c408da05493d4ac114
humanhash: diet-grey-hot-solar
File name:SOA.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:589'312 bytes
First seen:2022-06-28 16:24:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:DSIxi+tW7pVUxcWYnx9sXXynwiaeq+8mMt:epTUCWYxYXyntaeq+8my
TLSH T1EFC4935C3B110F62EC0D91388E439AAB7B620F732E40A981A7DB1DDBA7DF1D56C05D86
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 00525232c8cc2408 (10 x Formbook, 4 x RedLineStealer, 1 x AveMariaRAT)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
107.182.128.57:48273

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
107.182.128.57:48273 https://threatfox.abuse.ch/ioc/732121/

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/283995/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Running batch commands
Creating a file in the %AppData% subdirectories
Creating a file
Sending a custom TCP request
Sending an HTTP POST request
Creating a file in the %temp% directory
Reading critical registry keys
Using the Windows Management Instrumentation requests
Creating a window
Creating a process from a recently created file
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd.exe obfuscated packed
Link:
https://www.filescan.io/uploads/62bb2b60197c837506cc884b/reports/c03b2933-7fdd-484e-a762-3cfd6c0539bb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4252b824-1dbe-4c96-b931-8b1607f2627e
Result
Threat name:
Ficker Stealer, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1021389
Signature
Binary or sample is protected by dotNetProtector
Connects to many ports of the same IP (likely port scanning)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Ficker Stealer
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 653883 Sample: SOA.exe Startdate: 28/06/2022 Architecture: WINDOWS Score: 100 74 Malicious sample detected (through community Yara rule) 2->74 76 Yara detected RedLine Stealer 2->76 78 Yara detected Ficker Stealer 2->78 80 6 other signatures 2->80 7 SOA.exe 2 2->7         started        10 reader.exe 1 2->10         started        13 reader.exe 2->13         started        process3 file4 56 C:\Users\user\AppData\Local\...\SOA.exe.log, ASCII 7->56 dropped 15 vbc.exe 15 29 7->15         started        19 cmd.exe 1 7->19         started        21 cmd.exe 3 7->21         started        82 Multi AV Scanner detection for dropped file 10->82 24 vbc.exe 11 10->24         started        26 cmd.exe 10->26         started        28 cmd.exe 10->28         started        30 cmd.exe 13->30         started        32 vbc.exe 13->32         started        34 cmd.exe 13->34         started        signatures5 process6 dnsIp7 58 107.182.128.57, 48273, 49758, 49772 META-ASUS Reserved 15->58 60 api.ip.sb 15->60 64 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->64 66 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->66 68 Tries to harvest and steal browser information (history, passwords, etc) 15->68 36 conhost.exe 15->36         started        70 Uses schtasks.exe or at.exe to add and modify task schedules 19->70 48 2 other processes 19->48 54 C:\Users\user\AppData\Roaming\...\reader.exe, PE32 21->54 dropped 38 conhost.exe 21->38         started        62 api.ip.sb 24->62 72 Tries to steal Crypto Currency Wallets 24->72 40 conhost.exe 24->40         started        50 2 other processes 26->50 42 conhost.exe 28->42         started        52 2 other processes 30->52 44 conhost.exe 32->44         started        46 conhost.exe 34->46         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a23c3c4409f2674964a29f8cee7a95834440c94225cfaa915d342edd1896ea30/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-28 16:25:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
46
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ui6dyraj6jtuszfct6go46uvqncebskcexh2vek5gqxn2gew5iya._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:wizzy infostealer spyware
Link:
https://tria.ge/reports/220628-twydsaagdj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
107.182.128.57:48273
Unpacked files
SH256 hash:
c4c0b9b00ae42816734508128f273af5426b04ca35bdc59a98df96a98ae09163
MD5 hash:
2711b11c1d29df86c33e2c14131de327
SHA1 hash:
e0763c079c78e3bd659fcd9ca2f49bd64aac0cea
Link:
https://www.unpac.me/results/47bca4c7-59c8-4ad3-95bc-0fa0b879c686/
SH256 hash:
a23c3c4409f2674964a29f8cee7a95834440c94225cfaa915d342edd1896ea30
MD5 hash:
2751a07a258d21c408da05493d4ac114
SHA1 hash:
eb8ecb2c3d7f509d050be27da8d7636eed649bef
Link:
https://www.unpac.me/results/47bca4c7-59c8-4ad3-95bc-0fa0b879c686/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a23c3c4409f2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a23c3c4409f2674964a29f8cee7a95834440c94225cfaa915d342edd1896ea30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Babel
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Babel
Rule name:INDICATOR_EXE_Packed_Dotfuscator
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Dotfuscator
Rule name:INDICATOR_EXE_Packed_dotNetProtector
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with dotNetProtector
Rule name:INDICATOR_EXE_Packed_Goliath
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Goliath
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine_a
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Redline_Stealer_Monitor
Create hunting rule
Description:Detects RedLine Stealer Variants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/283995/

Comments