MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7
SHA3-384 hash: e627b5cc8c81c2f570f8b0e3c59fda82cab11914b2359d5b926073c9b1cf594e288d91aa5c09f15109c7710313e33ca3
SHA1 hash: b8f481af1a86b28c904df2cf56ca54f92da8112b
MD5 hash: 5d189e938902eaae6f0f249af89acaa0
humanhash: gee-virginia-kentucky-arizona
File name:SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'021'672 bytes
First seen:2021-12-06 04:32:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:+6FePODGuoYPQh5mfeWVJeNYURZLlefS+YncT23GaUeDH4+D++m8:NFePPGf1SNrLMscT+GLefm
Threatray 1'843 similar samples on MalwareBazaar
TLSH T125257C29A2F1BE29C3D66637C029C45096D2DB442663E36AF9FB12931F4F3B10DDA1D4
Reporter SecuriteInfoCom
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:Missayings
Issuer:Missayings
Algorithm:sha1WithRSAEncryption
Valid from:2021-11-24T21:00:00Z
Valid to:2031-12-01T21:00:00Z
Serial number: 1811c13c2e6addbd4dd7263f9a515f35
Thumbprint Algorithm:SHA256
Thumbprint: 36815fdb39e7b2bfae4458015e2efac8893fdcda99243b75dc2cdf99fdb1da25
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://5bwo.komawai.ru/SomanCoccygeal.exe
Verdict:
Malicious activity
Analysis date:
2021-12-03 03:42:17 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/df43bd27-3e57-4757-a421-c386fa3a6d86

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/211613/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Unauthorized injection to a recently created process
Creating a file
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed
Link:
https://www.filescan.io/uploads/61ad928447ed217c01330d11/reports/ca2a767f-8992-4d18-95f0-6d73229f3755/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e67c364f-bbcf-4dc1-aea4-55e08bdb9a78
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/901948
Signature
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Conti Backup Database
Sigma detected: Disable or Delete Windows Eventlog
Sigma detected: PowerShell SAM Copy
Sigma detected: Suspicious PowerShell Invocations - Generic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 534427 Sample: SecuriteInfo.com.Trojan.PWS... Startdate: 06/12/2021 Architecture: WINDOWS Score: 100 25 www.google.com 2->25 33 Found malware configuration 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected RedLine Stealer 2->37 39 5 other signatures 2->39 8 SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.exe 3 2->8         started        signatures3 process4 file5 21 SecuriteInfo.com.T...23048.15661.exe.log, ASCII 8->21 dropped 41 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->41 43 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->43 45 Injects a PE file into a foreign processes 8->45 12 SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.exe 15 6 8->12         started        17 SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.exe 8->17         started        signatures6 process7 dnsIp8 27 45.150.67.236, 33584, 49754 ASDETUKhttpwwwheficedcomGB Montenegro 12->27 29 cdn.discordapp.com 162.159.133.233, 443, 49761 CLOUDFLARENETUS United States 12->29 31 192.168.2.1 unknown unknown 12->31 23 C:\Users\user\AppData\Roaming\xfiles.exe, PE32+ 12->23 dropped 47 Tries to harvest and steal browser information (history, passwords, etc) 12->47 49 Tries to steal Crypto Currency Wallets 12->49 19 xfiles.exe 2 12->19         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-12-02 19:23:45 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 44 (63.64%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ksewgan5war5xvwaz3htex77swof3ih3r7doqj7zmsml3oj73dq._file
Verdict:
malicious
Similar samples:
07de0324fd15b8dab3b0c9e4345a2ecc0d2bc0c806f6702cda99e480e9d6506c
RedLineStealer
397e0884e0fd1223b63edf2c687a7467111d5a3bdfdfa817838acf06339c545c
RedLineStealer
5a68552297b1a15eb91df368e34aff338f266f188d853f83ce800c7de7fdaa48
RedLineStealer
7148bb41fee90f24843a31006add5c84e658ccc3583149c0b2b01d6b69aaeaca
RedLineStealer
a766e503479650b215fc12a81a528fb194eeca14687a289ff63e3ccaa000dbfd
RedLineStealer
a852cb7d026a381e651188d0b7a88fa5cd8720c46b29f7331ec3fddc40d6167a
RedLineStealer
d19fdf53603310203c8bc83e1d27e14b60cac0a65932fe3824dedca50ff5c0a9
RedLineStealer
+ 1'833 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:12345 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/211206-e6ks4sdcgp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
45.150.67.236:33584
Unpacked files
SH256 hash:
9f994a5eea7bcbc4849181b08fd130fd3649971793fa1c53d00e57cd06145a45
MD5 hash:
74008d76ada243693efbb39164686d10
SHA1 hash:
22d4f46733ba0724074de2b65f1272b81dc8d935
Link:
https://www.unpac.me/results/ed5aff60-8dfd-4f37-8649-9a265f28bc8a/
SH256 hash:
daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7
MD5 hash:
5d189e938902eaae6f0f249af89acaa0
SHA1 hash:
b8f481af1a86b28c904df2cf56ca54f92da8112b
Link:
https://www.unpac.me/results/ed5aff60-8dfd-4f37-8649-9a265f28bc8a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/daa44b180ded/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1856776/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/211613/

Comments