MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c
SHA3-384 hash: 51b954b84563f6af0317af501183d58414d98e0c48d5efa0880f42a6216e3b6c770fc41d90d2b5ead695f8d800ae5d42
SHA1 hash: 9693b7e106d41af60a22b952ed8c24d2552c4fed
MD5 hash: 73579a608e55e865564046dee680520a
humanhash: bakerloo-gee-timing-east
File name:UnlimitedPrimogems.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'460'899 bytes
First seen:2021-10-28 18:58:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a1a66d588dcf1394354ebf6ec400c223 (49 x RedLineStealer, 7 x CryptBot, 4 x AZORult)
ssdeep 49152:p5+hF+1D+z3xVALWB7qZjAA/Y90WVKbjHT2c1ixiz8lVHTIioOFZQ+O:p5aFTLx6LbcCv1ixiqZ7O
Threatray 526 similar samples on MalwareBazaar
TLSH T19AB533116EEE93B7F1A3373118C4B72A76FAEA190B0364C79388A9067C417D0C6BE517
File icon (PE):PE icon
dhash icon 6192a6a6a6a6c401 (17 x RedLineStealer, 11 x PythonStealer, 9 x DCRat)
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
UnlimitedPrimogems.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-28 18:55:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/944b1505-64f5-4dcd-956f-5a50bdc70a84

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/201031/
Detection(s):
Win.Trojan.Generic-9874371-0
Create hunting rule

Win.Malware.Drivepack-9884589-1
Create hunting rule

Win.Packed.Drivepack-9895006-1
Create hunting rule

Win.Packed.Drivepack-9895007-1
Create hunting rule

SecuriteInfo.com.Artemis8A5D1E11C3D3.26302.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/741e7457-73d9-44ce-a03e-4a742d8c3c07
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/878832
Signature
Connects to many ports of the same IP (likely port scanning)
Contains functionality to register a low level keyboard hook
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 18:59:05 UTC
AV detection:
12 of 44 (27.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vqlfug3k44oxuuoimfzzy25pqhdsfcrwcycgbs5iuent4auf75wa._file
Verdict:
malicious
Similar samples:
1505d3b595d18d1b255253b080bed85334916ff81174a5685a6f3f3433cbe746
RedLineStealer
28ec9e6646d64704bd53325f0c48ef5383ff671547838d1833a470c9a04bc246
RedLineStealer
773b40c8007545afd1b563bdf17dab8225acd4bd6def35e4db95f70fca16371c
RedLineStealer
852a677fbc8242015c84b8d00234ea00eb5be4a10c0eef80b2ab17dd3471496e
RedLineStealer
9e3f93ae0a1f76351b69714917b3f1cd965b09e2e696964b28d693c14f71f007
RedLineStealer
d3cfc436366c9d127c7a6233f6531cf6e5863153b41ba4ab6f8fe87f473c8c9d
RedLineStealer
f82bb3ac18ad4a4c4226cddfdb81b305a2252affa4fcaeab8685ddfe468fba48
RedLineStealer
fbf130705ed4de523fd2e38a6c64848af5d6e1ce6a268251e7b6d6e3f8089957
RedLineStealer
+ 516 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@geniyvseg0 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211028-xm276aghar/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
62.182.156.24:12780
Unpacked files
SH256 hash:
aa12edbcfd0c74c6a4a1e35e1b05ff40f3c4246297a2b22967b44640a14097a5
MD5 hash:
984717debd72fa494829366d87fc7cc3
SHA1 hash:
352c04e9effb8e81164c0195549d043eda7f2078
Link:
https://www.unpac.me/results/895aa00c-f269-4d90-8fc6-8b900392d105/
SH256 hash:
ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c
MD5 hash:
73579a608e55e865564046dee680520a
SHA1 hash:
9693b7e106d41af60a22b952ed8c24d2552c4fed
Link:
https://www.unpac.me/results/895aa00c-f269-4d90-8fc6-8b900392d105/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ac165a1b6ae7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ac165a1b6ae71d7a51c861739c6baf81c7228a36160460cba8a11b3e0285ff6c

(this sample)

anyrun
any.run
https://app.any.run/tasks/944b1505-64f5-4dcd-956f-5a50bdc70a84/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/201031/

Comments