MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a77affc8aade0e41bacc74406c6db70c087971dad3f5acb73eaa0531ecb0135f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a77affc8aade0e41bacc74406c6db70c087971dad3f5acb73eaa0531ecb0135f
SHA3-384 hash: 43a53f4c5554d9f410c40dc906c7c0c167293052a1a6b1cd6aaf7b9b816b950ab8894218ce4ddf786e35fa8a3918006b
SHA1 hash: bb80ab4779cf894e86bf9f13970518697c81d889
MD5 hash: 291192d5184d78dc4f49972a092598d8
humanhash: speaker-wisconsin-uniform-pizza
File name:291192d5184d78dc4f49972a092598d8
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'103'360 bytes
First seen:2021-07-18 23:44:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:xAHnh+eWsN3skA4RV1Hom2KXMmHa1ggWBKRtD5:Ih+ZkldoPK8Ya+gDV
Threatray 1'488 similar samples on MalwareBazaar
TLSH T1C835BF037791C076FFAB92739B5AF20556BD6D290123852F13982DB9BDB01B1233E663
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
291192d5184d78dc4f49972a092598d8
Verdict:
Malicious activity
Analysis date:
2021-07-18 23:46:44 UTC
Tags:
evasion loader
Link:
https://app.any.run/tasks/3561882d-0aa1-482b-9524-f351b3a4794f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172449/
Detection(s):
Win.Malware.Autoit-9849407-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca51f67b-4e4e-4b26-a6e6-3b2eb9add983
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817978
Signature
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses ping.exe to check the status of other devices and networks
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 450389 Sample: Q54JbvBq3c Startdate: 19/07/2021 Architecture: WINDOWS Score: 100 48 d350tlfey47vr7.cloudfront.net 2->48 50 bin.bnbstatic.com 2->50 76 Found malware configuration 2->76 78 Antivirus detection for URL or domain 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 4 other signatures 2->82 8 Q54JbvBq3c.exe 23 2->8         started        signatures3 process4 dnsIp5 70 tstamore.info 45.139.184.124, 49712, 49732, 49778 HostingvpsvilleruRU Russian Federation 8->70 72 iplogger.com 88.99.66.31, 443, 49710 HETZNER-ASDE Germany 8->72 74 usa01.info 8->74 40 C:\Users\user\AppData\...\1819228598.exe, PE32 8->40 dropped 42 C:\Users\user\AppData\...\1586857311.exe, PE32 8->42 dropped 44 C:\Users\user\AppData\Local\...\compan[1].exe, PE32 8->44 dropped 46 C:\Users\user\AppData\Local\...\m[1].exe, PE32 8->46 dropped 88 Binary is likely a compiled AutoIt script file 8->88 13 1586857311.exe 1 8->13         started        16 1819228598.exe 1 8->16         started        18 cmd.exe 8->18         started        20 chrome.exe 8->20         started        file6 signatures7 process8 dnsIp9 90 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->90 92 Performs DNS queries to domains with low reputation 13->92 94 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->94 23 1586857311.exe 14 30 13->23         started        96 Injects a PE file into a foreign processes 16->96 27 1819228598.exe 15 24 16->27         started        29 1819228598.exe 16->29         started        98 Uses ping.exe to check the status of other devices and networks 18->98 31 conhost.exe 18->31         started        33 PING.EXE 18->33         started        52 192.168.2.1 unknown unknown 20->52 54 239.255.255.250 unknown Reserved 20->54 35 chrome.exe 20->35         started        signatures10 process11 dnsIp12 56 densalenge.xyz 85.192.56.21, 49792, 49798, 49799 DINET-ASRU Russian Federation 23->56 58 api.ip.sb 23->58 84 Tries to harvest and steal browser information (history, passwords, etc) 23->84 86 Tries to steal Crypto Currency Wallets 23->86 60 tstamore.info 27->60 62 api.ip.sb 27->62 64 googlehosted.l.googleusercontent.com 216.58.212.161, 443, 49762 GOOGLEUS United States 35->64 66 o529943.ingest.sentry.io 34.120.195.249, 443, 49752 GOOGLEUS United States 35->66 68 13 other IPs or domains 35->68 38 C:\Users\user\AppData\Local\...\Cookies, SQLite 35->38 dropped file13 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a77affc8aade0e41bacc74406c6db70c087971dad3f5acb73eaa0531ecb0135f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-18 23:45:05 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u55p7sfk3yhedowmoragy3nxbqehs4o22p22znz6victd3fqcnpq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
00ac3efa4faaa3927d28bf7b78793d4dac0c814cdbefb2015734d76bee8c988f
RedLineStealer
12344b1913ac3ae118e0924428330f30f3987737a6582094686c286c0de3faa7
RedLineStealer
1ba812e8f200b18b8f04bf694314c9b5127aa8a3ce5351ac389639fb69d6d528
RedLineStealer
1ced01c2c4455606d8ed1eda83bd1507785d4c97fc8c7967bda90cd91ba82e32
RedLineStealer
36ef5e0db18469267810503ba4fd099e59007c3f10f718bccffdc93e87a853a0
RedLineStealer
76b87f4f61c849a8af46ebdcb899a0bea036b18f6b473bed34562212eab16b93
RedLineStealer
88c98c6871442d02b5f26dc7625926c1dcd4de88a7d31bc53786f6182204c902
RedLineStealer
8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
RedLineStealer
bf86597d2d10ad8d82f0af8b53cf72757094322e79e92180092aa60341b90034
RedLineStealer
eddbfe52ba633950c388e0303d5a04453f9ba9e3a3cdc60f9a1355707cd209e6
RedLineStealer
+ 1'478 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:500 botnet:al discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210718-bpvxgvpmy6/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
tstamore.info:80
densalenge.xyz:80
Unpacked files
SH256 hash:
a77affc8aade0e41bacc74406c6db70c087971dad3f5acb73eaa0531ecb0135f
MD5 hash:
291192d5184d78dc4f49972a092598d8
SHA1 hash:
bb80ab4779cf894e86bf9f13970518697c81d889
Link:
https://www.unpac.me/results/b23e3dcb-3cfc-49be-9926-12c59e3894a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a77affc8aade0e41bacc74406c6db70c087971dad3f5acb73eaa0531ecb0135f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe a77affc8aade0e41bacc74406c6db70c087971dad3f5acb73eaa0531ecb0135f

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172449/

Comments


Avatar
zbet commented on 2021-07-18 23:44:49 UTC

url : hxxp://name-usa.info/app/files/dc/id27315002/compan.exe