MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277
SHA3-384 hash: 38de713fe4c9fdd339e9edb059ab0e96c399abdc8cfd5f7c87bf7d8a9b84627b3f004a4d1c2424369da913ba152e1616
SHA1 hash: 617035b2440359bcaac218f661932b71a533242d
MD5 hash: a147b64b431e73eb793c61ee4bb39495
humanhash: moon-sixteen-failed-lake
File name:LauncherHack.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:492'960 bytes
First seen:2021-10-30 14:07:22 UTC
Last seen:2021-10-30 15:23:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 6144:nKqvz2PdqQT21ohahldLslNveYjK970aFXFMxKxhSJ2PFX5N1et/rKd:nKqvzgh21NLuWYYIaUxKHNPFX5N1erKd
Threatray 1'623 similar samples on MalwareBazaar
TLSH T1B9A4322921D6C713CA8475B6CAB7AE14BB3309FB47534BE85BCB87F846051292E02F75
Reporter tech_skeech
Tags:exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.215.113.57:50723 https://threatfox.abuse.ch/ioc/239871/

Intelligence

File Origin
# of uploads :
2
# of downloads :
287
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
LauncherHack.exe
Verdict:
No threats detected
Analysis date:
2021-10-30 14:04:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f1b46c8d-808d-41b9-ab72-19f255c38e0a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Virus.Win32.Save.a.5299.4413.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Forced shutdown of a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e25ff1c2-21f1-44ad-9f9f-b0b296a54ba0
Result
Threat name:
BitCoin Miner RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879834
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Powershell download and execute file
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 512264 Sample: LauncherHack.exe Startdate: 30/10/2021 Architecture: WINDOWS Score: 100 115 Found malware configuration 2->115 117 Sigma detected: Powershell download and execute file 2->117 119 Multi AV Scanner detection for submitted file 2->119 121 5 other signatures 2->121 14 LauncherHack.exe 3 2->14         started        18 fghfgh.exe 2->18         started        process3 file4 103 C:\Users\user\...\LauncherHack.exe.log, ASCII 14->103 dropped 179 Writes to foreign memory regions 14->179 181 Injects a PE file into a foreign processes 14->181 20 RegAsm.exe 15 7 14->20         started        183 Antivirus detection for dropped file 18->183 185 Multi AV Scanner detection for dropped file 18->185 187 Allocates memory in foreign processes 18->187 189 Creates a thread in another existing process (thread injection) 18->189 25 conhost.exe 18->25         started        signatures5 process6 dnsIp7 105 185.215.113.57, 49784, 50723 WHOLESALECONNECTIONSNL Portugal 20->105 107 cdn.discordapp.com 162.159.134.233, 443, 49798 CLOUDFLARENETUS United States 20->107 97 C:\Users\user\AppData\Local\Temp\fl.exe, PE32 20->97 dropped 141 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->141 143 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 20->143 145 Tries to harvest and steal browser information (history, passwords, etc) 20->145 147 Tries to steal Crypto Currency Wallets 20->147 27 fl.exe 20->27         started        149 Adds a directory exclusion to Windows Defender 25->149 30 sihost32.exe 25->30         started        32 cmd.exe 25->32         started        34 cmd.exe 25->34         started        file8 signatures9 process10 signatures11 151 Multi AV Scanner detection for dropped file 27->151 153 Adds a directory exclusion to Windows Defender 27->153 36 cmd.exe 1 27->36         started        155 Writes to foreign memory regions 30->155 157 Allocates memory in foreign processes 30->157 159 Creates a thread in another existing process (thread injection) 30->159 39 conhost.exe 30->39         started        41 conhost.exe 32->41         started        43 powershell.exe 32->43         started        45 powershell.exe 32->45         started        47 conhost.exe 34->47         started        49 taskkill.exe 34->49         started        process12 signatures13 125 Suspicious powershell command line found 36->125 127 Tries to download and execute files (via powershell) 36->127 129 Adds a directory exclusion to Windows Defender 36->129 51 powershell.exe 36->51         started        53 powershell.exe 22 36->53         started        56 conhost.exe 36->56         started        58 2 other processes 36->58 process14 dnsIp15 62 ytbxcs.exe 51->62         started        131 Powershell drops PE file 53->131 133 Adds a directory exclusion to Windows Defender 56->133 109 162.159.135.233, 443, 49848 CLOUDFLARENETUS United States 58->109 111 192.168.2.1 unknown unknown 58->111 113 cdn.discordapp.com 58->113 99 C:\Users\user\AppData\Local\Temp\ytbxcs.exe, PE32+ 58->99 dropped file16 signatures17 process18 signatures19 171 Antivirus detection for dropped file 62->171 173 Multi AV Scanner detection for dropped file 62->173 175 Writes to foreign memory regions 62->175 177 2 other signatures 62->177 65 conhost.exe 62->65         started        process20 file21 95 C:\Windows\System32\fghfgh.exe, PE32+ 65->95 dropped 123 Adds a directory exclusion to Windows Defender 65->123 69 cmd.exe 65->69         started        72 cmd.exe 65->72         started        74 cmd.exe 65->74         started        signatures22 process23 signatures24 135 Drops executables to the windows directory (C:\Windows) and starts them 69->135 76 fghfgh.exe 69->76         started        79 conhost.exe 69->79         started        137 Uses schtasks.exe or at.exe to add and modify task schedules 72->137 139 Adds a directory exclusion to Windows Defender 72->139 81 conhost.exe 72->81         started        83 powershell.exe 72->83         started        85 powershell.exe 72->85         started        87 conhost.exe 74->87         started        89 schtasks.exe 74->89         started        process25 signatures26 161 Writes to foreign memory regions 76->161 163 Allocates memory in foreign processes 76->163 165 Creates a thread in another existing process (thread injection) 76->165 91 conhost.exe 76->91         started        process27 file28 101 C:\Windows\System32\...\sihost32.exe, PE32+ 91->101 dropped 167 Drops executables to the windows directory (C:\Windows) and starts them 91->167 169 Adds a directory exclusion to Windows Defender 91->169 signatures29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-30 14:08:06 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkxkzn3wcxbtiubgtv5icuiaragw7eqltgwjchwvcgjfa2opuj3q._file
Verdict:
malicious
Similar samples:
0ac33d8c3cbc892f96da5a1fcbd912f21aa77c464fea12d57651494404831225
RedLineStealer
0ee84fc4a946d3857e7c2fe363c73a42274f9ab9d30975e625350ff0bfa2b6c7
RedLineStealer
3974c6e4ebb068f2600005739259d63edfac659dea5a3b7d17cd8c7d3e248aa3
RedLineStealer
4d07b5da2a5e18574654be096b110e8df7ebf8d8950239d05d9457562d80e094
RedLineStealer
702d02cc220387cd8f2029520cde97bd3879a1e151b198b4e3faea08b808cc9a
RedLineStealer
73d7def516f13281fd06673ef3b5b87eb99ba4f708dbfa78a11bf0de94b23df1
RedLineStealer
e6dff8475541ebddc1f0db47a311eb2c25581b7d5e62af8066d59c283114c2d3
RedLineStealer
f51fc0ab96d1aee49950b8ca91ef67c330b8593340cc3002513100ac9bf163b0
RedLineStealer
f9194db6a27bfd9322186caf3fa8337f6b5197301798818920e84724362ee801
RedLineStealer
+ 1'613 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211030-rfj54sfad2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine Payload
Malware Config
C2 Extraction:
185.215.113.57:50723
Unpacked files
SH256 hash:
6b8fa9de69e1f17e5b55a169b328a18709db4579b6a8584c21d6988118151c8f
MD5 hash:
20545724377b2da2ac4b06500d77823a
SHA1 hash:
1dad53270b6e883db811aa561747b0681c02263d
Link:
https://www.unpac.me/results/178313ad-4426-434e-8fcb-97e71578c615/
SH256 hash:
b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277
MD5 hash:
a147b64b431e73eb793c61ee4bb39495
SHA1 hash:
617035b2440359bcaac218f661932b71a533242d
Link:
https://www.unpac.me/results/178313ad-4426-434e-8fcb-97e71578c615/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe b2aeacb77615c33450269d7a815100880d6f920b99ac911ed511925069cfa277

(this sample)

anyrun
any.run
https://app.any.run/tasks/f1b46c8d-808d-41b9-ab72-19f255c38e0a/
  
Delivery method
Distributed via web download

Comments