MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4
SHA3-384 hash: 29b71de12ea1211826615522cf1025b911117bd6c24b20772f4bc701967b4371db799da61714c602f25e9e4e8e5b639f
SHA1 hash: b6e09252e6f2a6ec29ddf546e26f72e125733ef8
MD5 hash: 4712c552dcbe7f40c6613eedae028f29
humanhash: california-comet-robin-summer
File name:4712c552dcbe7f40c6613eedae028f29.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:8'126'467 bytes
First seen:2023-02-17 20:40:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 69 x LummaStealer, 61 x Rhadamanthys)
ssdeep 196608:kuYO0UCRLljm7rZCDniV0aPLHn6lNa1zWuQy0umK9S4:wbXpjyF2niVfD6lozRQy0u1S
Threatray 139 similar samples on MalwareBazaar
TLSH T10086333F93B5A5E1D86C47B89FF805A24931B6A08058C8FB63E1C4AD9C335642A7CF57
TrID 83.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
6.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
4.4% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
49.12.184.163:28786

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
4712c552dcbe7f40c6613eedae028f29.exe
Verdict:
Malicious activity
Analysis date:
2023-02-17 20:43:41 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/9bbd7bed-a5b7-4705-947d-0518de3c9bd4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/367800/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.18513.31275.18664.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Сreating synchronization primitives
Moving a file to the %AppData% subdirectory
Enabling the 'hidden' option for recently created files
Running batch commands
DNS request
Sending a custom TCP request
Launching a process
Adding an access-denied ACE
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/71400/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
83%
Tags:
advpack.dll autoit cerbu overlay packed rundll32.exe setupapi.dll shell32.dll virus
Link:
https://www.filescan.io/uploads/63efe660bc5c84d0ee7cda7e/reports/98d81174-d550-49b8-bf1c-3d26ecebfc4c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/29cd1655-074f-4c18-a452-d2278339e86b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1178256
Signature
Binary is likely a compiled AutoIt script file
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 811082 Sample: jhmXv7kmjO.exe Startdate: 17/02/2023 Architecture: WINDOWS Score: 100 43 Multi AV Scanner detection for domain / URL 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 5 other signatures 2->49 8 jhmXv7kmjO.exe 1 4 2->8         started        11 usbperf.exe 2->11         started        14 usbperf.exe 2->14         started        16 2 other processes 2->16 process3 file4 35 C:\Users\user\AppData\Local\...\RODINA~1.EXE, PE32 8->35 dropped 37 C:\Users\user\AppData\Local\...\ARIZON~1.EXE, PE32 8->37 dropped 18 RODINA~1.EXE 13 8->18         started        59 Query firmware table information (likely to detect VMs) 11->59 61 Hides threads from debuggers 11->61 63 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->63 signatures5 process6 dnsIp7 39 maper.info 148.251.234.93, 443, 49695 HETZNER-ASDE Germany 18->39 41 192.168.2.1 unknown unknown 18->41 33 C:\Users\user\AppData\...\usbperf.exe (copy), PE32 18->33 dropped 51 Multi AV Scanner detection for dropped file 18->51 53 Query firmware table information (likely to detect VMs) 18->53 55 Hides threads from debuggers 18->55 57 Tries to detect sandboxes / dynamic malware analysis system (registry check) 18->57 23 cmd.exe 1 18->23         started        file8 signatures9 process10 process11 25 conhost.exe 23->25         started        27 icacls.exe 1 23->27         started        29 icacls.exe 1 23->29         started        31 icacls.exe 1 23->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4/
Threat name:
Win64.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-02-14 12:25:47 UTC
File Type:
PE+ (Exe)
Extracted files:
63
AV detection:
21 of 39 (53.85%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3juyepcs35lmqlmz6o5n5oyrultpqdynsnt6bm3giypponi76hca._file
Verdict:
malicious
Similar samples:
045d257fff1a2678715e67b6ce278456bd264514598fd51a3fc8023d58f64c3a
RedLineStealer
068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
RedLineStealer
0dd1d1a74f49a15f9b7dcfc7890060807198b74b835cb17f60886a0f2c9c1376
RedLineStealer
28ca1fe12d85075d947b1bc3292c14cba784ed1e22287e56819d9a1d86b2f7e4
RedLineStealer
2ee350a3c3c03283a1458ff5e3e142d91b46a8fecd846ec8df0d1edca7c1e4cf
RedLineStealer
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1
RedLineStealer
4ba96ecdcdfa746de28a0ee3ef474842e829917c9486ace35ec4cc2fa1ad956f
RedLineStealer
927a4dddb1e5ffe4ba3a9a8ba4183c092eb350fb07ea79fecd84042c812f6dbc
RedLineStealer
a2cbf70ab3ebedd2c768816596fade8e94d1dd0d6025001ac59a71860e45b808
RedLineStealer
+ 129 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/230217-zgewsahd43/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Executes dropped EXE
Modifies file permissions
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4
MD5 hash:
4712c552dcbe7f40c6613eedae028f29
SHA1 hash:
b6e09252e6f2a6ec29ddf546e26f72e125733ef8
Link:
https://www.unpac.me/results/647017d1-feee-4bbe-9f50-b054d19499b6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/367800/

Comments