MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236
SHA3-384 hash: ba752192dfa7cfe977789a5a1a1983b12dbceeb3828e8312efc65acaa5dcd12f38c49fbe221f1f28ae1d2dd70fa8e6f0
SHA1 hash: 6560d991ed13cbe736f625a8a5d347f5a46f4970
MD5 hash: 7e7d5f990c1ec4aec6ea3e97d6e3869d
humanhash: arkansas-winter-oklahoma-india
File name:IcePick.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:7'661'307 bytes
First seen:2021-10-18 21:26:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cfda23baf1e2e983ddfeca47a5c755a (33 x RedLineStealer, 6 x Dridex, 5 x NetSupport)
ssdeep 196608:ubEslMEi8Vk+g474G/4vz4sz9bVjJToo39YDB52B5:u4gViskX4V/4v0Knj17YD65
TLSH T15C7633B079CFC072D74525769C25AAD27F1A3CB1527154AFFBE426AE6232B14AC31313
File icon (PE):PE icon
dhash icon 4810707161701068 (3 x RedLineStealer)
Reporter JaffaCakes118
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
266
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IcePick.exe
Verdict:
Malicious activity
Analysis date:
2021-10-18 21:26:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fbed67bf-8ec7-4385-b4b3-7a74cea3d0e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198330/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop7.53194.14125.546.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% directory
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/616de6aca9d585e6d52c7dca/reports/e276698a-9407-48a4-a827-f1bb2978133d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ddb00be-75d1-4b8a-a09b-ee251fa52f3b
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/872693
Signature
Allocates memory in foreign processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 505120 Sample: IcePick.exe Startdate: 18/10/2021 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected RedLine Stealer 2->44 46 3 other signatures 2->46 8 IcePick.exe 9 2->8         started        process3 file4 24 C:\Users\user\AppData\...\UpdateChecker.exe, PE32 8->24 dropped 26 C:\Users\user\AppData\...\Hobbistical.exe, PE32+ 8->26 dropped 11 UpdateChecker.exe 8->11         started        14 Hobbistical.exe 3 8->14         started        process5 signatures6 48 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->48 50 Machine Learning detection for dropped file 11->50 52 Tries to shutdown other security tools via broadcasted WM_QUERYENDSESSION 11->52 56 4 other signatures 11->56 16 AppLaunch.exe 15 6 11->16         started        20 WerFault.exe 23 9 11->20         started        54 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->54 process7 dnsIp8 28 185.195.26.13, 47288, 49755 SUPERSERVERSDATACENTERRU Russian Federation 16->28 30 to.homereds.site 45.130.41.15, 443, 49758 BEGET-ASRU Russian Federation 16->30 32 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->32 34 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->34 36 Tries to harvest and steal browser information (history, passwords, etc) 16->36 38 Tries to steal Crypto Currency Wallets 16->38 22 conhost.exe 16->22         started        signatures9 process10
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 21:27:09 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xz46tzrwrbhdctm7gawbmhlbknem7aov4ybazgemg7qkkqnyki3a._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:onyxx0 infostealer spyware
Link:
https://tria.ge/reports/211018-1ar37sehf3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Executes dropped EXE
RedLine
RedLine Payload
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
185.195.26.13:47288
Unpacked files
SH256 hash:
62e02fdb045146c9952ede260cd305ea3dc86dec9488b0ea3b672b2145cd8dc7
MD5 hash:
3ace1eeacfad4e3f23ab19e15fe39886
SHA1 hash:
e4d6e7f14748e1e0488e466daecebbd7ffae1b41
Link:
https://www.unpac.me/results/45ea2248-7519-4a9d-a0f6-4371f7f5b06e/
SH256 hash:
03c32b10aa47522bed05ba0a10b0dc7baeb7b7e4cdf3d324a7813fef1b1f5cea
MD5 hash:
1d1f605d3fdfc49c051eee885ce71d56
SHA1 hash:
7d208575d5f63c3985056ae16e5225e8681f3841
Link:
https://www.unpac.me/results/45ea2248-7519-4a9d-a0f6-4371f7f5b06e/
SH256 hash:
be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236
MD5 hash:
7e7d5f990c1ec4aec6ea3e97d6e3869d
SHA1 hash:
6560d991ed13cbe736f625a8a5d347f5a46f4970
Link:
https://www.unpac.me/results/45ea2248-7519-4a9d-a0f6-4371f7f5b06e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/be79e9e63688/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe be79e9e636884e314d9f302c161d615348cf81d5e6020c988c37e0a541b85236

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/198330/

Comments