MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs 1 YARA 1 File information Comments 1

SHA256 hash:	bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e
SHA3-384 hash:	762c226890bdf7c9919966ad7f2869555fe3e5e9af5964bbbd4bb1ec9502d4edb0ec5f769ace62cefffb81b7661b465a
SHA1 hash:	adab9f57069d87789a3cac61727accedf7ca5e0c
MD5 hash:	48f4118cba6173a45ae20a3ed629520e
humanhash:	carpet-steak-ten-lactose
File name:	48f4118cba6173a45ae20a3ed629520e.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	323'584 bytes
First seen:	2021-04-21 15:01:04 UTC
Last seen:	2021-04-21 16:07:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8fd60dafad060fd6212af469fec2faa3 (5 x ArkeiStealer, 4 x RedLineStealer)
ssdeep	6144:hjlLg56xtyLgxz4dQ6IHPIYvggzgUCGsPQM:htg5oy+z4dQLHPIQM
Threatray	715 similar samples on MalwareBazaar
TLSH	A664D010B3D0D532C0535176432AC3B18E7E7876252AA9AFBFC86BB55F343E1EA16319
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
87.251.71.148:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
87.251.71.148:80	https://threatfox.abuse.ch/ioc/9375/

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/142209/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.16542.18996.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/691337

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e/

Threat name:

Win32.Trojan.Fugrafa

Status:

Malicious

First seen:

2021-04-21 15:15:16 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xmcxz7odoexybn2lznhgiwezbbbvygeecoqi4zdbtfodrdk2eepa._file

Verdict:

malicious

RedLineStealer

2efb4d4bb7e9141474ee5ae3f8c40274c5ab675b33836ac31a8ec554dd76a9bf

RedLineStealer

667d6191eab21dca3a07f01b287a4a4d35c719885b712eeaf3fedeeeb8b16e4f

RedLineStealer

76b9e7cad6719da5975a769160602a67877e0e1748375280831f1f25b4558f48

RedLineStealer

7b9bd29f5c0787b2937b34493ca5a7128d476dc9f4257643f1fd47d48399eafa

RedLineStealer

877c1cec3dce25939698f1f459f4b68a1d9ecdb3c7ebc82f241e136ead494731

RedLineStealer

94e489927f1f04b50d80382b4ebbb245d8b0cd55f36dac8d7de3c543cbf361fb

RedLineStealer

e273f65f5eff32aa37c8e88a9cc825b4826eabc8b8e708d850a0b4a3bdd60b8a

RedLineStealer

f01f44864129ba56c115b4c4dcaf8373a1f7996a142e17ffcf4d7f4f875bcdaa

RedLineStealer

f3ec960fde547dac872a3fe8ee59c3beb063457673fcf50480e20c886c7f17fa

RedLineStealer

+ 705 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:118 discovery infostealer spyware stealer

Link:

https://tria.ge/reports/210421-fpa36ys8ze/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine Payload

Malware Config

C2 Extraction:

bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekshen
Description:	Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe bb057cfdc3712f80b74bcb4e64589908435c188413a08e6461995c388d5a211e

(this sample)

Cape

https://www.capesandbox.com/analysis/142209/

URLhaus

https://urlhaus.abuse.ch/url/1147433/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-21 16:12:10 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
1) [B0012.001] Anti-Static Analysis::Argument Obfuscation
2) [C0003.002] Communication Micro-objective::Connect Pipe::Interprocess Communication
3) [C0049] File System Micro-objective::Get File Attributes
4) [C0051] File System Micro-objective::Read File
5) [C0052] File System Micro-objective::Writes File
6) [C0007] Memory Micro-objective::Allocate Memory
7) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
8) [C0040] Process Micro-objective::Allocate Thread Local Storage
9) [C0041] Process Micro-objective::Set Thread Local Storage Value
10) [C0018] Process Micro-objective::Terminate Process