MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21
SHA3-384 hash: 76d6eeabeabfecb6b5efd72a7e81dc2bc79acb9274fa9e5ea46c3291bc14dc37c696177f9a68e7167c92c7bdad03c3c8
SHA1 hash: 65f3373423fd2620530f3e0551304ad2ea838063
MD5 hash: 5a66d163366de0461ea3a97b192f2f68
humanhash: purple-winner-avocado-foxtrot
File name:5a66d163366de0461ea3a97b192f2f68
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:397'312 bytes
First seen:2021-10-16 13:53:24 UTC
Last seen:2021-10-16 15:20:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3053f2a72602e54beffbd9d286711499 (2 x RedLineStealer, 1 x Tofsee, 1 x Smoke Loader)
ssdeep 6144:0V4oJNYQqbxInrBdHJVjVkM0TJZTNowW6DKxMX5B6WSOGt43GQ2AYH/:0SQNAyrx5VkPdts6GxMXuWxGQ2AY
Threatray 32 similar samples on MalwareBazaar
TLSH T10684BF10A7A0C034F1B722F85A7A9375A93F7DE09B64A4CF62D126EA57346D1EC3035B
File icon (PE):PE icon
dhash icon ccf0e8e4e0f06808 (1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
379
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5a66d163366de0461ea3a97b192f2f68
Verdict:
Malicious activity
Analysis date:
2021-10-16 13:55:59 UTC
Tags:
trojan evasion loader
Link:
https://app.any.run/tasks/195dfa00-0cad-4b95-a8f3-a52ace78da52

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Gcleaner
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197869/
Detection(s):
SecuriteInfo.com.Variant.Jaik.48516.3056.25887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/616ad9809a5a1e91c5c28f0e/reports/16188bbe-7e0d-4633-a991-e6f5aa87488f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/485c2756-4fe4-4694-b083-eb68d7e3eec3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/871564
Signature
Antivirus detection for URL or domain
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 503988 Sample: pd6pz6O97w Startdate: 16/10/2021 Architecture: WINDOWS Score: 80 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Multi AV Scanner detection for domain / URL 2->44 46 Antivirus detection for URL or domain 2->46 48 2 other signatures 2->48 7 pd6pz6O97w.exe 2 2->7         started        process3 dnsIp4 38 89.191.227.244, 49775, 80 MGNHOST-ASRU Russian Federation 7->38 40 ppp-gl.biz 5.230.71.242, 49773, 80 ASGHOSTNETDE Germany 7->40 50 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 7->50 11 WerFault.exe 9 7->11         started        14 WerFault.exe 9 7->14         started        16 WerFault.exe 9 7->16         started        18 5 other processes 7->18 signatures5 process6 file7 24 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 11->24 dropped 26 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 14->26 dropped 28 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->30 dropped 32 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->32 dropped 34 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->34 dropped 36 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->36 dropped 20 taskkill.exe 1 18->20         started        22 conhost.exe 18->22         started        process8
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21/
Threat name:
Win32.Trojan.Jaik
Create hunting rule
Status:
Malicious
First seen:
2021-10-16 13:54:08 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgfk2lzpnxlzrszogduw2kbfvkocdqzgcgtjs6iddhmuw4fzfyqq._file
Verdict:
malicious
Similar samples:
79d1a0d0bd8b5672374ab7c97365a6b0276efc6755900cdbdcdb77019e69457a
RedLineStealer
84b57d3d7fdabaebcd85cf01dbf14b9cb94e08fe081abcb60b218c1298c55995
RedLineStealer
8d53be201d501a00295678466c9fe32c1a972faa705cd6b24636f789a349bb73
RedLineStealer
8e58fc8da8ccaf2d46f5592cb0842894007b9c0cafaac82a87b140f9de8914b9
RedLineStealer
ca77cc344a3c2f6ab1cbee4e6da2ba30f3a14b824bdc00a0da73271e8c365e14
RedLineStealer
ccfd37710068b3998537ac325e29555ba9375ebf1230cf90e9dcf133e06bcdf3
RedLineStealer
e045b4a1c9f6640814f6e39903e1f03f2c7f1e3b3d1c6dbf07a409732655eff4
RedLineStealer
e390ebfd3537c9b4210916f4e7762e4c12b5fc8825c93e65e3f01fc9f44ac16b
RedLineStealer
fe622c4801737dede008dfecf2bcf48316f0adebbc080d27a2664ee8b606415c
RedLineStealer
+ 22 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:cryptbot family:redline botnet:default botnet:mix16.10 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211016-q7jg8acad3/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Arkei Stealer Payload
Arkei
CryptBot
RedLine
RedLine Payload
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://game2030.link/ggate.php
cemfyj62.top
morota06.top
185.215.113.15:57055
Unpacked files
SH256 hash:
630a641bebd6ded36fb1c42520e4c7ddc5ace49436dede6c255d8f12ddbfbe54
MD5 hash:
cbbdd5a549a37602019203e20a21866a
SHA1 hash:
50c80b98548b24565decfa94c034b43b753a197a
Link:
https://www.unpac.me/results/3bb1efdd-363b-4f97-8c4d-03896364135f/
SH256 hash:
b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21
MD5 hash:
5a66d163366de0461ea3a97b192f2f68
SHA1 hash:
65f3373423fd2620530f3e0551304ad2ea838063
Link:
https://www.unpac.me/results/3bb1efdd-363b-4f97-8c4d-03896364135f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_AHK_Downloader
Create hunting rule
Author:ditekSHen
Description:Detects AutoHotKey binaries acting as second stage droppers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_RedLineDropperAHK
Create hunting rule
Author:ditekSHen
Description:Detects AutoIt/AutoHotKey executables dropping RedLine infostealer
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe b18aad2f2f6dd798cb2e30e96d2825aa9c21c32611a699790319d94b70b92e21

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197869/

Comments


Avatar
zbet commented on 2021-10-16 13:53:25 UTC

url : hxxp://45.9.20.156/pub.php?pub=two/