MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84
SHA3-384 hash: 4698b4a91aafd6f40b45ab5c4ad9e177577a7114248be1c9fce90534be97d34d88694912327136bb4dbe18a80e36f4a3
SHA1 hash: 157f7306ff5b4ff9332570d631f7d5ce27df78cd
MD5 hash: d4a4093dcc7dabb6e9d9b57aaa159ac9
humanhash: purple-louisiana-video-four
File name:farcry6_repack.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'168'384 bytes
First seen:2021-10-13 18:29:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 80 x RedLineStealer)
ssdeep 24576:FFofQDykb6wCihobn3IZCIPrU+k1MeKn1v2nuktSTm:Hykb3CT0ZbPRk1/K1eptE
Threatray 45 similar samples on MalwareBazaar
TLSH T13745331D03FE2700D2AA2970BE2EDDD84D642D5DD761899F182FD854EDE4489EE0BF18
Reporter Anonymous
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
farcry6_repack.exe
Verdict:
Malicious activity
Analysis date:
2021-10-13 18:30:00 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/fd57f270-4f80-428e-b957-1fcd61194415

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
EnigmaStub
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197368/
Detection(s):
PUA.Win.Packer.EnigmaProtector-19
Create hunting rule

PUA.Win.Packer.EnigmaProtector-1
Create hunting rule

PUA.Win.Packer.EnigmaProtector-9852682-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% directory
Connection attempt to an infection source
Sending a TCP request to an infection source
Query of malicious DNS domain
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive packed
Link:
https://www.filescan.io/uploads/616725aefd35fe780c3de02e/reports/0efe208a-4eb2-46fc-a272-9253c6a34e9e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/edf50230-8ff9-4da0-8715-c0cef505eb80
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/869936
Signature
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 502367 Sample: farcry6_repack.exe Startdate: 13/10/2021 Architecture: WINDOWS Score: 100 51 Found malware configuration 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 Yara detected RedLine Stealer 2->55 57 4 other signatures 2->57 7 farcry6_repack.exe 15 8 2->7         started        12 msiexec.exe 3 10 2->12         started        process3 dnsIp4 45 185.209.22.181, 34925, 49755 ON-LINE-DATAServerlocation-NetherlandsDrontenNL Ukraine 7->45 47 1fv1.ckauni.ru 81.177.141.85, 443, 49756 RTCOMM-ASRU Russian Federation 7->47 49 2 other IPs or domains 7->49 25 C:\Users\user\...\farcry6_repack.exe.log, ASCII 7->25 dropped 27 C:\Users\user\AppData\Local\...\LibRender.exe, PE32 7->27 dropped 59 Detected unpacking (changes PE section rights) 7->59 61 Detected unpacking (overwrites its own PE header) 7->61 63 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->63 65 5 other signatures 7->65 14 LibRender.exe 239 7->14         started        17 conhost.exe 7->17         started        29 C:\Windows\Installer\MSI9A2D.tmp, PE32 12->29 dropped 31 C:\Windows\Installer\MSI9896.tmp, PE32 12->31 dropped 33 C:\Windows\Installer\MSI95E5.tmp, PE32 12->33 dropped 35 3 other files (none is malicious) 12->35 dropped 19 msiexec.exe 12->19         started        21 msiexec.exe 12->21         started        file5 signatures6 process7 file8 37 C:\Users\user\AppData\Roaming\...\decoder.dll, PE32 14->37 dropped 39 C:\Users\user\AppData\...\ssleay32.dll, PE32 14->39 dropped 41 C:\Users\user\AppData\...\pthreadGC2.dll, PE32 14->41 dropped 43 33 other files (none is malicious) 14->43 dropped 23 msiexec.exe 2 14->23         started        process9
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-13 18:32:31 UTC
AV detection:
20 of 39 (51.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3qcqxfr4mqxinp3u3jpil674wcz4ck6wskaix6fockrw6s6phsca._file
Verdict:
malicious
Similar samples:
3555826df75751600d127b343a3214a0f9b4c211b1fdcdf9ccceb1dda6be5f27
RedLineStealer
42e369c8a08e42bb7ca81f3b4598b1352766fd602c32adc21cd5f1afab85f7f3
RedLineStealer
446736e381fa8942f8d32cb4f2ae8fb6a9245fa0e70b7f7298ee7a5cb6fe9f32
RedLineStealer
4f2ada4fba44e50c0c23762724b98dcd98d54340ace84ea1493358987c3dfebd
RedLineStealer
73c1188d93bd4318a830cb6d891aae7580a61c396ce37ba3676a321bbd3a137e
RedLineStealer
96f69fe5148b0838909afe927aa280b4919b7f12b1593ed4a461de49fa725b1b
RedLineStealer
ec5e384e2dc1a77a23eaf3130d6fe73abf081fa7433e0d67295926943813a2c9
RedLineStealer
+ 35 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion spyware stealer
Link:
https://tria.ge/reports/211013-w5gthaegcn/
Behaviour
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Modifies security service
Unpacked files
SH256 hash:
dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84
MD5 hash:
d4a4093dcc7dabb6e9d9b57aaa159ac9
SHA1 hash:
157f7306ff5b4ff9332570d631f7d5ce27df78cd
Link:
https://www.unpac.me/results/aad8cdb0-c57f-4af9-af1e-a0b2e436d2fd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/dc050b963c64/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.62
Link:
https://yomi.yoroi.company/submissions/dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaPacker_Rare
Create hunting rule
Author:Florian Roth
Description:Detects an ENIGMA packed executable
Reference:Internal Research
Rule name:EnigmaPacker_Rare_RID2DA1
Create hunting rule
Author:Florian Roth
Description:Detects an ENIGMA packed executable
Reference:Internal Research
Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.smominru.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe dc050b963c642e86bf74da5e85fbfcb0b3c12bd692808bf8ae12a36f4bcf3c84

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197368/

Comments