MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27
SHA3-384 hash: 2a428d4fee5d3b42114adf9beda8ccfcb8b2479fb54ab928f673a4e33d1fb9f78b18a0b4e02ba2a8b67668c73b81e0d6
SHA1 hash: 769a18362f774c73b7b28b94befeb8fb202fc6c9
MD5 hash: 04470d4da868648287ebb3669b0cf749
humanhash: potato-zulu-yellow-fifteen
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'486'752 bytes
First seen:2023-03-08 20:31:08 UTC
Last seen:2023-03-08 21:15:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash caf9bf1d191236de3d7b150ac6f71de5 (2 x ManusCrypt, 1 x Rhadamanthys, 1 x RedLineStealer)
ssdeep 24576:W9qjb+9R49lDm0g+JO82Zj+fugNGKu8qpuGA2zxeqp7V3VU6rpUUlUI+NY5L12+0:Webwy9NdI82Zj+f7kKpuW2VRZ+Qw+1VC
Threatray 249 similar samples on MalwareBazaar
TLSH T1EF65E0045976D938C1B60C34DE2B5BEB234A29FA15A88D727395DABC3DB1E23045BD3C
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10523/12/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0d8f4c4f4c8e0cc (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:*.zaborfh.com
Issuer:R3
Algorithm:sha256WithRSAEncryption
Valid from:2023-02-28T13:00:07Z
Valid to:2023-05-29T13:00:06Z
Serial number: 0327bbfe1e937752f35d7901a0dfcffaaca8
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b42fea2fbdf123406fa5a866cb4ef725ca3f8f5e5077a6c46eed01e819ef847b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://vk.com/doc10773776_660815668?hash=Zwel1wBis9LM2Yn3c6NC8Nogb60cAgRjyii1x7yfZeH&dl=GEYDONZTG43TM:1678293050:aN8kyCoxoj104ZkA4tofKMnYJ5UPYj3ogXRK3Bz4grH&api=1&no_preview=1#fy10

Intelligence

File Origin
# of uploads :
2
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2023-03-08 20:34:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/620465c9-c60b-4a89-81c9-8846470d128c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/372695/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Launching a process
Creating a file in the %temp% directory
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Сreating synchronization primitives
Detecting VM
Changing a file
Sending an HTTP GET request
Searching for the window
Creating a process with a hidden window
Creating a process from a recently created file
Stealing user critical data
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6408f0c3ce680ea731cc5268/reports/52ff154b-84fe-401b-9041-46e0aade419a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/81a9a126-50de-42c2-b97a-04c32f5dc92b
Result
Threat name:
RHADAMANTHYS, RedLine
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1189993
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Found potential ransomware demand text
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RedLine Stealer
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 822867 Sample: file.exe Startdate: 09/03/2023 Architecture: WINDOWS Score: 100 60 Snort IDS alert for network traffic 2->60 62 Malicious sample detected (through community Yara rule) 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 12 other signatures 2->66 10 file.exe 9 2->10         started        process3 dnsIp4 54 cpuhknhdtwymsva48cfeka4msfzv.1hwzkbr9szh9zf 10->54 44 C:\Users\user\AppData\Local\...\3755968.dll, PE32 10->44 dropped 76 Writes to foreign memory regions 10->76 78 Allocates memory in foreign processes 10->78 80 Injects a PE file into a foreign processes 10->80 15 fontview.exe 10->15         started        18 ngentask.exe 5 10->18         started        21 ngentask.exe 10->21         started        file5 signatures6 process7 dnsIp8 84 Query firmware table information (likely to detect VMs) 15->84 86 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 15->86 88 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->88 98 5 other signatures 15->98 23 dllhost.exe 15->23         started        52 185.244.182.218, 2027, 49697 BELCLOUDBG Russian Federation 18->52 90 Tries to harvest and steal browser information (history, passwords, etc) 18->90 92 Tries to steal Crypto Currency Wallets 18->92 94 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->94 96 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->96 signatures9 process10 signatures11 68 Early bird code injection technique detected 23->68 70 Tries to harvest and steal browser information (history, passwords, etc) 23->70 72 Maps a DLL or memory area into another process 23->72 74 Queues an APC in another process (thread injection) 23->74 26 dllhost.exe 14 27 23->26         started        process12 dnsIp13 56 185.246.220.34, 443, 49700, 49701 LVLT-10753US Germany 26->56 58 192.168.2.1 unknown unknown 26->58 46 C:\Users\user\AppData\...\Xmgduchfvo.exe, PE32+ 26->46 dropped 48 C:\Users\user\AppData\...\Cgzafhitrr.exe, PE32+ 26->48 dropped 50 C:\Users\user\AppData\...\xkyhw2h1.cmdline, Unicode 26->50 dropped 30 Xmgduchfvo.exe 2 26->30         started        33 csc.exe 3 26->33         started        36 Cgzafhitrr.exe 2 26->36         started        file14 process15 file16 82 Machine Learning detection for dropped file 30->82 42 C:\Users\user\AppData\Local\...\xkyhw2h1.dll, PE32 33->42 dropped 38 conhost.exe 33->38         started        40 cvtres.exe 1 33->40         started        signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-03-08 20:59:28 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
15 of 25 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3p24fagyxllwxgp5ryirhf67l7iduubiz3k4vpriciabprexditq._file
Verdict:
malicious
Similar samples:
044e62e14faf9e06d2759ac0d62b4c6cb3a103fe287e235c48ab1c64604cfe3a
RedLineStealer
07ef3c17f83a7edd9e2c820c10d1b24bb21804a734a1d6e6de9d9bcf1e9426e1
RedLineStealer
343b71456cdcc0f09baf79a2b0f5befe7043f329899f205699ac3ca2424c8282
RedLineStealer
3ce93785a441fb0908cf3ceed6dd1fe76a9d5133ed52ca7b278dc5d81f8fb1f0
RedLineStealer
3dbb485f94bffbb6e070780451ccda0c651520b651ae9f2f763a8ff9fa70060e
RedLineStealer
4fc39495038014b3e49eb088c92c9310487beca6a027ebc72d60607a05b4f331
RedLineStealer
95df8e09db02d2956bdd6a91041e3424020e9dc1e2775bac33b6c0af30fada43
RedLineStealer
dc999c9387fdf2312df82d98d0efdab722010a333b6bce2250b3433ba98d8469
RedLineStealer
e09f0bd79308d5a35381b2921ca5f0f609225120157de3d093554eb4b611839e
RedLineStealer
+ 239 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:redline family:rhadamanthys botnet:@rozebalpedistall infostealer spyware stealer
Link:
https://tria.ge/reports/230308-za94cagh49/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Detect rhadamanthys stealer shellcode
RedLine
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
185.244.182.218:2027
Unpacked files
SH256 hash:
1844a954b214dc99c6fa4e7241863318eddcdcb1203201a711afb2e50b748d13
MD5 hash:
28277b8fc1deccdc36ff74c029c8fab2
SHA1 hash:
b46a204ff66bd2b256b334d85f743d4f5819aa6c
Link:
https://www.unpac.me/results/17fa8cc0-73f8-4136-bc93-44f8f9009a95/
SH256 hash:
dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27
MD5 hash:
04470d4da868648287ebb3669b0cf749
SHA1 hash:
769a18362f774c73b7b28b94befeb8fb202fc6c9
Link:
https://www.unpac.me/results/17fa8cc0-73f8-4136-bc93-44f8f9009a95/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dbf5c280d8ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/dbf5c280d8bad76b99fd8e111397df5fd03a5028ced5cabe28120017c4971a27

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Redline_Hunter
Create hunting rule
Author:Potato
Description:Unpacked RedLine Hunter
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/372695/

Comments