MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b964ae40cbc0dd892a8210187d7198c6a946e5dee5f2b54efc43dc6da7cab1f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b964ae40cbc0dd892a8210187d7198c6a946e5dee5f2b54efc43dc6da7cab1f6
SHA3-384 hash: 9574e6c86742f3ffb73bb56fb8f5027d33b54a89b28fcd4983da3d62a5f60c51169a0ad26a336db2adbdc3da99c633b6
SHA1 hash: 45bde0c5d9666ef22a5fc1959025f494ffd3d028
MD5 hash: 85ac18793faef760b8f16b15e6b6ccd2
humanhash: juliet-west-east-ceiling
File name:Genshin Hack.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:349'592 bytes
First seen:2021-11-14 06:31:13 UTC
Last seen:2021-11-14 09:10:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:nWgaXtcpiI2895cJFDJPm1iLLlAs13WkyNXqgBEnO:nPUl095czDJu1i3VXgCO
Threatray 40 similar samples on MalwareBazaar
TLSH T1067413032D46FA5CF1673F3382DB1EA10F9B9DD14A32C99A1E099B5963539022D37B39
Reporter tech_skeech
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205590/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.39783.29875.13830.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Connection attempt
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Sending a UDP request
Sending an HTTP POST request
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a file
Running batch commands
Launching a process
Unauthorized injection to a recently created process
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Downloading the file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated overlay packed packed
Link:
https://www.filescan.io/uploads/6190ad65dec3347825a4228f/reports/3d3742d6-5ffc-4949-838e-092a84e7614e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a3fbbe4-620d-40cf-a369-785250ce8d02
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888769
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Powershell download and execute file
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected BitCoin Miner
Yara detected Telegram Recon
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 521242 Sample: Genshin Hack.exe Startdate: 14/11/2021 Architecture: WINDOWS Score: 100 97 Multi AV Scanner detection for domain / URL 2->97 99 Antivirus detection for URL or domain 2->99 101 Sigma detected: Powershell download and execute file 2->101 103 9 other signatures 2->103 13 Genshin Hack.exe 14 7 2->13         started        18 services32.exe 2->18         started        process3 dnsIp4 87 antivirf.ru 81.177.141.85, 443, 49725, 49732 RTCOMM-ASRU Russian Federation 13->87 89 45.137.190.237, 27973, 49724 BITWEB-ASRU Russian Federation 13->89 79 C:\Users\user\AppData\Local\Temp\kolopl.exe, PE32 13->79 dropped 81 C:\Users\user\...behaviorgraphenshin Hack.exe.log, ASCII 13->81 dropped 149 Tries to harvest and steal browser information (history, passwords, etc) 13->149 151 Tries to steal Crypto Currency Wallets 13->151 20 kolopl.exe 13->20         started        153 Multi AV Scanner detection for dropped file 18->153 155 Writes to foreign memory regions 18->155 157 Allocates memory in foreign processes 18->157 159 Creates a thread in another existing process (thread injection) 18->159 23 conhost.exe 18->23         started        file5 signatures6 process7 signatures8 105 Multi AV Scanner detection for dropped file 20->105 107 Adds a directory exclusion to Windows Defender 20->107 25 cmd.exe 1 20->25         started        109 Drops executables to the windows directory (C:\Windows) and starts them 23->109 28 sihost32.exe 23->28         started        process9 signatures10 117 Suspicious powershell command line found 25->117 119 Tries to download and execute files (via powershell) 25->119 121 Adds a directory exclusion to Windows Defender 25->121 30 powershell.exe 25->30         started        32 powershell.exe 25->32         started        34 powershell.exe 25->34         started        40 4 other processes 25->40 123 Multi AV Scanner detection for dropped file 28->123 125 Writes to foreign memory regions 28->125 127 Allocates memory in foreign processes 28->127 129 Creates a thread in another existing process (thread injection) 28->129 38 conhost.exe 28->38         started        process11 dnsIp12 43 kolop.exe 30->43         started        46 kolopp.exe 32->46         started        83 antivirf.ru 34->83 73 C:\Users\user\AppData\Roaming\kolop.exe, PE32+ 34->73 dropped 85 antivirf.ru 40->85 75 C:\Users\user\AppData\Roaming\kolopp.exe, PE32 40->75 dropped 115 Powershell drops PE file 40->115 file13 signatures14 process15 dnsIp16 131 Multi AV Scanner detection for dropped file 43->131 133 Writes to foreign memory regions 43->133 135 Allocates memory in foreign processes 43->135 137 Creates a thread in another existing process (thread injection) 43->137 49 conhost.exe 43->49         started        91 ip-api.com 208.95.112.1, 49772, 80 TUT-ASUS United States 46->91 93 api.telegram.org 149.154.167.220, 443, 49773 TELEGRAMRU United Kingdom 46->93 95 192.168.2.1 unknown unknown 46->95 139 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 46->139 141 May check the online IP address of the machine 46->141 52 conhost.exe 46->52         started        signatures17 process18 file19 71 C:\Windows\System32\services32.exe, PE32+ 49->71 dropped 54 cmd.exe 49->54         started        57 cmd.exe 49->57         started        process20 signatures21 111 Drops executables to the windows directory (C:\Windows) and starts them 54->111 59 services32.exe 54->59         started        62 conhost.exe 54->62         started        113 Uses schtasks.exe or at.exe to add and modify task schedules 57->113 64 conhost.exe 57->64         started        66 schtasks.exe 57->66         started        process22 signatures23 143 Writes to foreign memory regions 59->143 145 Allocates memory in foreign processes 59->145 147 Creates a thread in another existing process (thread injection) 59->147 68 conhost.exe 59->68         started        process24 file25 77 C:\Windows\System32\...\sihost32.exe, PE32+ 68->77 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b964ae40cbc0dd892a8210187d7198c6a946e5dee5f2b54efc43dc6da7cab1f6/
Threat name:
ByteCode-MSIL.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2021-11-14 06:32:07 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
06b9c1418f1db6092d2f85eed6f479a667e4901accb6bbe789545c247d588232
RedLineStealer
1e18bdbb00ab59d4e8692f898a0d05f4aceece07ec6a457b8705b795b732e6e5
RedLineStealer
28ae75452f06cfa45dc41a0329aeff5630f92189188523cd6d663b98a4fbccc6
RedLineStealer
4248b627c09a67e427dcb07d55df46103915fcccb673a422a1a6543f3bc0afa4
RedLineStealer
52f81503c78310cb6a7636ddce30b78d55bb82022782efcb8b9d2a172af62de4
RedLineStealer
591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c
RedLineStealer
d3f77ae659c38c08c8c39fde6c8e5900817e2032b5b8e96de98811b00889b486
RedLineStealer
f5faced81151871dd7ecd897e8c41dccf60eeadc7598563baeba61c66a743e4a
RedLineStealer
f81d585bfc44f4b92707d848715c2225a863196bade7cec2e5306e36fe179365
RedLineStealer
+ 30 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:xxluchxx1 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211114-hal8vafhh6/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.137.190.237:27973
212.86.102.63:62907
Unpacked files
SH256 hash:
3dbd6f2d0e549d7e321eac18301db0cea6e0b08e7d6071f64038e07472bd330b
MD5 hash:
8e466e9c4f6e713a9e1ebf8cbd7d9a60
SHA1 hash:
db8267c55d884d51ded0c7f5029031c1f9cfabe4
Link:
https://www.unpac.me/results/4b3790ee-5fda-4c62-bc80-072b0ad33bee/
SH256 hash:
b964ae40cbc0dd892a8210187d7198c6a946e5dee5f2b54efc43dc6da7cab1f6
MD5 hash:
85ac18793faef760b8f16b15e6b6ccd2
SHA1 hash:
45bde0c5d9666ef22a5fc1959025f494ffd3d028
Link:
https://www.unpac.me/results/4b3790ee-5fda-4c62-bc80-072b0ad33bee/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b964ae40cbc0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe b964ae40cbc0dd892a8210187d7198c6a946e5dee5f2b54efc43dc6da7cab1f6

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205590/

Comments