MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba483bee9e68e055952e71255eb24bd6ca52c1238d3efe96bcb66506e80e6792. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba483bee9e68e055952e71255eb24bd6ca52c1238d3efe96bcb66506e80e6792
SHA3-384 hash: d5c1dcf1bad45d514ab45c2ddfbff71c762ba9b8f6ae94ab7acabf188ee1d39906e701de47d7d58b39c61a6f775f44be
SHA1 hash: d2578d8ce1dacdad808f88c682aa3a6d0e00e71f
MD5 hash: 9bf1c67dbbc2b863c6254ef7415bb434
humanhash: indigo-north-october-lion
File name:9bf1c67dbbc2b863c6254ef7415bb434.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:731'648 bytes
First seen:2020-12-08 07:07:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:3CeQUsbjeTvSj/nSB0enhZoICe74fgCAwlfDjnks:9Zs+TEi0qhZo5y4oKk
Threatray 39 similar samples on MalwareBazaar
TLSH F6F4CF3F9B278915C0252DFECA93514D1FF89E037467EB23AA65382886BE3827D054D7
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://173.234.155.143:35253/IRemotePanel

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107166/
Detection(s):
SecuriteInfo.com.Artemis9BF1C67DBBC2.29946.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Running batch commands
Launching a process
Stealing user critical data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/557633
Signature
Antivirus detection for URL or domain
Binary contains a suspicious time stamp
Bypasses PowerShell execution policy
Creates files in alternative data streams (ADS)
Creates processes via WMI
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Suspicious Csc.exe Source File Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected AntiVM_3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 327914 Sample: CiNPLUJX3z.exe Startdate: 08/12/2020 Architecture: WINDOWS Score: 100 76 raw.githubusercontent.com 2->76 78 zrh.speedtest.gtt.net 2->78 80 9 other IPs or domains 2->80 84 Antivirus detection for URL or domain 2->84 86 Multi AV Scanner detection for submitted file 2->86 88 Yara detected RedLine Stealer 2->88 90 10 other signatures 2->90 10 CiNPLUJX3z.exe 3 2->10         started        14 explorer.exe 1 2->14         started        signatures3 process4 dnsIp5 66 C:\Users\user\AppData\...\CiNPLUJX3z.exe.log, ASCII 10->66 dropped 102 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->102 104 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 10->104 17 CiNPLUJX3z.exe 15 24 10->17         started        82 192.168.2.1 unknown unknown 14->82 106 Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes) 14->106 22 powershell.exe 14->22         started        file6 signatures7 process8 dnsIp9 70 api.ip.sb 17->70 72 WHOIS.RIPE.NET 193.0.6.135, 43, 49733 RIPE-NCC-ASReseauxIPEuropeensNetworkCoordinationCentre Netherlands 17->72 74 7 other IPs or domains 17->74 52 C:\Users\user\AppData\Local\Temp\helper.exe, PE32+ 17->52 dropped 92 Tries to harvest and steal browser information (history, passwords, etc) 17->92 24 helper.exe 15 17->24         started        54 C:\Windows\Branding\mediasvc.png, PE32+ 22->54 dropped 56 C:\Windows\Branding\mediasrv.png, PE32+ 22->56 dropped 58 C:\Users\user\AppData\...\hmkiu40p.cmdline, UTF-8 22->58 dropped 94 Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes) 22->94 96 Powershell drops PE file 22->96 28 csc.exe 22->28         started        30 powershell.exe 22->30         started        32 powershell.exe 22->32         started        34 2 other processes 22->34 file10 signatures11 process12 file13 60 C:\Users\user\AppData\...\list.txt:metadata, PE32+ 24->60 dropped 62 C:\Users\user\AppData\Local\Temp\...\list.txt, PE32+ 24->62 dropped 98 Multi AV Scanner detection for dropped file 24->98 100 Creates files in alternative data streams (ADS) 24->100 36 cmd.exe 1 24->36         started        64 C:\Users\user\AppData\Local\...\hmkiu40p.dll, PE32 28->64 dropped 38 cvtres.exe 28->38         started        40 conhost.exe 30->40         started        42 conhost.exe 32->42         started        44 conhost.exe 34->44         started        signatures14 process15 process16 46 rundll32.exe 5 36->46         started        50 conhost.exe 1 36->50         started        file17 68 C:\Users\user\AppData\Local\...\explorer.exe, PE32+ 46->68 dropped 108 Creates processes via WMI 46->108 110 Drops PE files with benign system names 46->110 signatures18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba483bee9e68e055952e71255eb24bd6ca52c1238d3efe96bcb66506e80e6792/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 07:31:02 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjedx3u6ndqflfjooesv5msl23fffqjdru7p5fv4wzsqn2aom6ja._file
Verdict:
suspicious
Similar samples:
0fce4c62d03dc1076db031e5770d863591801ce25f18f2f516205b35be85e9b5
RedLineStealer
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
RedLineStealer
9ab99b021cac114dbf496c1b48e7f704799a1ca7d8b1e7e4366743f2e0ebcdfd
RedLineStealer
a01cd6294d3b5bdf73771b113493d8a5c2df3f105db7d084b0729345a32a4453
RedLineStealer
b42b33ffa4b45bc81b71f13d89dc1283b155204913aa8362e99e9aa44366bfb2
RedLineStealer
bdda7b20a2773900ed2a046e25bbb583c906e818c355b3de59b0ff75e1f40780
RedLineStealer
c8f9155cc97bde13afcdba0abd2264f8a91c73c39a8cfb4f8559a8276237e708
RedLineStealer
ce2369f1ba154a1fdd0599648dfbe32d6ad832c25d3f043bbe6b456cee609eeb
RedLineStealer
f0b43b05479d8dde3603ef587da02925b703d7d5bc8332656ab9ca7f7e1554a4
RedLineStealer
f671b1f716f0176dbaec5ea7ca024cb32f65fe5ceceaf99a80ce080132ec9dd7
RedLineStealer
+ 29 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:redline discovery infostealer keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201208-qtdzh6erta/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks installed software on the system
Looks up external IP address via web service
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
RedLine
Unpacked files
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/4575ef7e-29a9-4eb5-8c35-94e77d34577f/
SH256 hash:
228c4ab31f86c8378ccc41f1ae51d1fe34be802c8cb1337afa0ab8bfb52ad79d
MD5 hash:
c552df52e7f536d30ec0e34fb15d1ca4
SHA1 hash:
4443f535d6efcf0d96f9b9e147423b33b220fe08
Detections:
win_redline_stealer_g0
Create hunting rule
Link:
https://www.unpac.me/results/4575ef7e-29a9-4eb5-8c35-94e77d34577f/
SH256 hash:
d342ef3339f9d5fefb791504c574b0ab310a82238e2e1d34d9e4e5775f9428b9
MD5 hash:
8a547f83d92dee39daab2217920a0e53
SHA1 hash:
bc4f1e0febcf4ae98c68223c81b35a4866f6cfbc
Link:
https://www.unpac.me/results/4575ef7e-29a9-4eb5-8c35-94e77d34577f/
SH256 hash:
ba483bee9e68e055952e71255eb24bd6ca52c1238d3efe96bcb66506e80e6792
MD5 hash:
9bf1c67dbbc2b863c6254ef7415bb434
SHA1 hash:
d2578d8ce1dacdad808f88c682aa3a6d0e00e71f
Link:
https://www.unpac.me/results/4575ef7e-29a9-4eb5-8c35-94e77d34577f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba483bee9e68e055952e71255eb24bd6ca52c1238d3efe96bcb66506e80e6792

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:SUSP_Reversed_Base64_Encoded_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an base64 encoded executable with reversed characters
Reference:Internal Research
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria
Rule name:win_redline_stealer_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Description:Detects unpacked main component of Redline Stealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe ba483bee9e68e055952e71255eb24bd6ca52c1238d3efe96bcb66506e80e6792

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/896517/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/896394/
Cape
Cape
https://www.capesandbox.com/analysis/107166/

Comments