MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3a1bdd3ea570b33d18209bcc19d229229c95de8d4b13ffe76248ca72c17e09c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3a1bdd3ea570b33d18209bcc19d229229c95de8d4b13ffe76248ca72c17e09c
SHA3-384 hash: aee6161a8d9387856c7a259d80ef1740c0583bbd8bb879956844e2ef30f7d2eedce36a1436e8d443bc758b5b7a95c4ea
SHA1 hash: f73cd85f1442ca337b069eb61481731b588e5799
MD5 hash: 2da09a30217238b84e87115ef698a720
humanhash: network-artist-washington-emma
File name:Installer.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'729'200 bytes
First seen:2022-02-05 20:05:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41304e4befbbd8a63ad6ec59f252160b (56 x RedLineStealer, 4 x RaccoonStealer, 2 x CoinMiner)
ssdeep 98304:fJwBI7lzey6pGuqvjKtT+cEpTgo03LNMPsr:fMI7Jek5LKtTkSNMPy
Threatray 70 similar samples on MalwareBazaar
TLSH T158063343D3E2B495E4C39630265F312792F897A16C78A8F2A5B5975C0AC8E71738EC38
Reporter JaffaCakes118
Tags:exe RedLineStealer

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.112.83.135:15482 https://threatfox.abuse.ch/ioc/373925/

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://www.mediafire.com/file/gyrn6s79j8vgc6v/Download.rar/file
Verdict:
Malicious activity
Analysis date:
2022-02-05 16:33:51 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/1e833373-ea73-4c4f-b58c-046371f30b86

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/233671/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Packed.Fragtor-9937217-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed raccoon yakes
Link:
https://www.filescan.io/uploads/61fed8bf9046890c53ae5ab1/reports/c0f66c15-2f02-404b-872b-bf964827df5c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a783e854-6e21-4cb1-99aa-458a38caa60c
Result
Threat name:
RedLine TON Miner
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/934622
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: File Created with System Process Name
Sigma detected: System File Execution Location Anomaly
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected TON Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 567096 Sample: Installer.exe Startdate: 05/02/2022 Architecture: WINDOWS Score: 100 104 Found malware configuration 2->104 106 Malicious sample detected (through community Yara rule) 2->106 108 Antivirus detection for URL or domain 2->108 110 9 other signatures 2->110 10 Installer.exe 2->10         started        13 RegHost.exe 2->13         started        process3 signatures4 116 Writes to foreign memory regions 10->116 118 Allocates memory in foreign processes 10->118 120 Tries to detect virtualization through RDTSC time measurements 10->120 122 Injects a PE file into a foreign processes 10->122 15 AppLaunch.exe 15 7 10->15         started        20 WerFault.exe 23 9 10->20         started        124 Multi AV Scanner detection for dropped file 13->124 126 Machine Learning detection for dropped file 13->126 128 Injects code into the Windows Explorer (explorer.exe) 13->128 130 Modifies the context of a thread in another process (thread injection) 13->130 22 explorer.exe 13->22         started        24 bfsvc.exe 13->24         started        26 conhost.exe 13->26         started        process5 dnsIp6 92 185.112.83.135, 15482, 49774, 49823 SUPERSERVERSDATACENTERRU Russian Federation 15->92 84 C:\Users\user\Desktop\rundll32.exe, PE32+ 15->84 dropped 96 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->96 98 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->98 100 Tries to harvest and steal browser information (history, passwords, etc) 15->100 102 Tries to steal Crypto Currency Wallets 15->102 28 rundll32.exe 1 2 15->28         started        86 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->86 dropped 94 192.168.2.1 unknown unknown 22->94 32 curl.exe 22->32         started        34 curl.exe 22->34         started        36 curl.exe 22->36         started        40 3 other processes 22->40 38 conhost.exe 24->38         started        file7 signatures8 process9 file10 88 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 28->88 dropped 132 Multi AV Scanner detection for dropped file 28->132 134 Machine Learning detection for dropped file 28->134 136 Injects code into the Windows Explorer (explorer.exe) 28->136 138 4 other signatures 28->138 42 explorer.exe 2 28->42         started        44 bfsvc.exe 1 28->44         started        46 conhost.exe 28->46         started        48 conhost.exe 32->48         started        50 conhost.exe 34->50         started        52 conhost.exe 36->52         started        54 conhost.exe 40->54         started        signatures11 process12 process13 56 RegHost.exe 42->56         started        59 curl.exe 1 42->59         started        62 curl.exe 1 42->62         started        66 11 other processes 42->66 64 conhost.exe 44->64         started        dnsIp14 112 Modifies the context of a thread in another process (thread injection) 56->112 114 Injects a PE file into a foreign processes 56->114 68 conhost.exe 56->68         started        90 185.137.234.33, 49825, 49826, 49827 SELECTELRU Russian Federation 59->90 70 conhost.exe 59->70         started        72 conhost.exe 62->72         started        74 conhost.exe 64->74         started        76 conhost.exe 66->76         started        78 conhost.exe 66->78         started        80 conhost.exe 66->80         started        82 7 other processes 66->82 signatures15 process16
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-05 20:06:17 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 43 (46.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2oq33u7kk4fthumcbg6mdhjcsiu4sxpi2syt77twesgkolax4coa._file
Verdict:
malicious
Similar samples:
1ed5934c95292cf6d732ae068e1ef5e5c057088b199031e8be45eaf26a475c67
RedLineStealer
4b53dc815775a5f6d377218f9bee6b102d49f5dfc678f5a939ec2e0be0890e4b
RedLineStealer
5285ffebc00e0e75efcb1944329d1708d658eb5b4e5928d191323d933a3673e4
RedLineStealer
5ed9c8e4709af1af34ea8d1e6d5177c3d164c62c7dece9adcdd3d9c1b402484f
RedLineStealer
8a76fd10a479dbf5bb5d60f6ef949641d2ef4f1262a6d9dd273cf93b7be934b3
RedLineStealer
8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3
RedLineStealer
9fcaa9da6fe7fa15f35c891d33764bd8d47e7e87702aae69c1d48612f97b3956
RedLineStealer
+ 60 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220205-yvd1zafac9/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
4a6ef71822e9ee60fc8d5be3ff6b27651832aa27547c605e51a097fafb07f02f
MD5 hash:
882a429b8b366c39b03c2efd4688cf31
SHA1 hash:
47354621bcae270efb9c4c68f8570b77d885ba7c
Link:
https://www.unpac.me/results/25d5ff82-b45c-4ea1-845a-2b58ef7677f8/
SH256 hash:
d3a1bdd3ea570b33d18209bcc19d229229c95de8d4b13ffe76248ca72c17e09c
MD5 hash:
2da09a30217238b84e87115ef698a720
SHA1 hash:
f73cd85f1442ca337b069eb61481731b588e5799
Link:
https://www.unpac.me/results/25d5ff82-b45c-4ea1-845a-2b58ef7677f8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d3a1bdd3ea57/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d3a1bdd3ea570b33d18209bcc19d229229c95de8d4b13ffe76248ca72c17e09c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe d3a1bdd3ea570b33d18209bcc19d229229c95de8d4b13ffe76248ca72c17e09c

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/233671/

Comments