MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd4a98c54832ec6b61160f7c214af65f476cc75659fc3ea0add868373022031e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 2 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd4a98c54832ec6b61160f7c214af65f476cc75659fc3ea0add868373022031e
SHA3-384 hash: a9bba5d04cf62d26a7ee116176719453ec8a12c72e39a845c26abbe8c2a31072d853e2bcf7c1166be886a608ba822e50
SHA1 hash: 1722e11871cbb0f055255584f89123d742d34cb6
MD5 hash: 9913b09f503d56b2ac15001fdfe118b8
humanhash: earth-single-maine-charlie
File name:9913b09f503d56b2ac15001fdfe118b8.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'168'832 bytes
First seen:2021-05-03 22:40:58 UTC
Last seen:2021-05-03 23:55:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:sQ9IawiHnttoLA3IkVKx0CStSlyrOzIwK5V+Jiupak2E1D0KZdPdqnTQ51R+:Aa7TOx0CStSoOzILV+JDHD0KZdsT
Threatray 178 similar samples on MalwareBazaar
TLSH 66A5BE597900D9E2E24A1833C3CF4D19437855306A6BE727ABA533BC0927F673D299CE
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.128.150.56:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.128.150.56:80 https://threatfox.abuse.ch/ioc/28219/
45.67.231.56:3214 https://threatfox.abuse.ch/ioc/28518/

Intelligence

File Origin
# of uploads :
3
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/149493/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46221969.25286.22964.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP POST request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Creating a process from a recently created file
Launching a process
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/709168
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 403508 Sample: 3ZtdRsbjxo.exe Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 Multi AV Scanner detection for submitted file 2->58 60 7 other signatures 2->60 8 3ZtdRsbjxo.exe 3 2->8         started        process3 file4 30 C:\Users\user\AppData\...\3ZtdRsbjxo.exe.log, ASCII 8->30 dropped 70 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->70 72 Performs DNS queries to domains with low reputation 8->72 74 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->74 76 Injects a PE file into a foreign processes 8->76 12 3ZtdRsbjxo.exe 17 41 8->12         started        signatures5 process6 dnsIp7 48 qutanal.xyz 45.128.150.56, 49704, 49706, 49707 ITLDC-NLUA Ukraine 12->48 50 api.ip.sb 12->50 52 3 other IPs or domains 12->52 32 C:\Users\user\AppData\Local\Temp\servs.exe, PE32 12->32 dropped 34 C:\Users\user\AppData\Local\Temp\s6rvs.exe, PE32 12->34 dropped 78 Tries to steal Crypto Currency Wallets 12->78 17 s6rvs.exe 12->17         started        21 servs.exe 14 2 12->21         started        23 iexplore.exe 2 54 12->23         started        file8 signatures9 process10 dnsIp11 36 api.ip.sb 17->36 38 45.67.231.56, 3214, 49718, 49720 SERVERIUS-ASNL Moldova Republic of 17->38 62 Multi AV Scanner detection for dropped file 17->62 64 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->64 66 Machine Learning detection for dropped file 17->66 68 3 other signatures 17->68 40 redworksite.info 109.248.175.17, 49717, 80 SURYA-ASRU Russian Federation 21->40 42 192.168.2.1 unknown unknown 23->42 44 iplogger.org 23->44 25 iexplore.exe 23->25         started        28 iexplore.exe 23->28         started        signatures12 process13 dnsIp14 46 iplogger.org 88.99.66.31, 443, 49712, 49713 HETZNER-ASDE Germany 25->46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd4a98c54832ec6b61160f7c214af65f476cc75659fc3ea0add868373022031e/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 22:41:07 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vfjrrkiglwgwyiwb56ccsxwl5dwzr2wlh6d5ifn3budombcampa._file
Verdict:
malicious
Similar samples:
1c0eb090ad769cdd943476e9300d57e553ad24f099408334b8c0370ee9bb7648
RedLineStealer
23b916e5bb30f814e9819cf3499fe56820380b827b20f595022eabbd47267374
RedLineStealer
377d26a6588706b8cfe01190404beffb8ef5331e0bc5fe629cfd0683d590dd0b
RedLineStealer
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
RedLineStealer
83836ff69fc304d684edf3d394d45f0d2a8755a4de2d0fd6b06261ffe9336ed7
RedLineStealer
916df1aaac228a40f1981b539742aee6d0009fdce746f14eb646a7c70fa2cc4d
RedLineStealer
91800daa547a2afed2b16ab87634d0466d24d8769b9573ac7ded4c9f94e627ba
RedLineStealer
cf1a8304da78b6286a412d33ef3e0390949eb83e5b08ad63c006ed578d5d4c95
RedLineStealer
e6df8346cb599d0947c86555aeb55d98dc665448222e383f2384789e78d9e3e6
RedLineStealer
f2e2cb71a06ac2a95a02168fc3d91f160e6e07ca19c5e6d3d708a9a486dd3f92
RedLineStealer
+ 168 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:anal discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210503-6r8pqxndhn/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
qutanal.xyz:80
Unpacked files
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
Link:
https://www.unpac.me/results/22978b86-86df-4c7b-a355-3d631fdabe31/
SH256 hash:
bf1160ea712d69a3db0861098ba7d164cf86fb8c7708c0f6d223ad07154e78ee
MD5 hash:
c2c58e403cbe7fa6c51533b9c7bae80c
SHA1 hash:
be02047a0bc811f65163d84f786a11f3047be8bb
Link:
https://www.unpac.me/results/22978b86-86df-4c7b-a355-3d631fdabe31/
SH256 hash:
4f909767382163adc08d68f1c6165ede353cec0a45ca80a5a4a056e18bcf21da
MD5 hash:
de21b2d13fd074a792f00336517abad1
SHA1 hash:
9f88e364c202e28f32726ff335cf7d72869d8011
Link:
https://www.unpac.me/results/22978b86-86df-4c7b-a355-3d631fdabe31/
SH256 hash:
dd4a98c54832ec6b61160f7c214af65f476cc75659fc3ea0add868373022031e
MD5 hash:
9913b09f503d56b2ac15001fdfe118b8
SHA1 hash:
1722e11871cbb0f055255584f89123d742d34cb6
Link:
https://www.unpac.me/results/22978b86-86df-4c7b-a355-3d631fdabe31/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.78
Link:
https://yomi.yoroi.company/submissions/dd4a98c54832ec6b61160f7c214af65f476cc75659fc3ea0add868373022031e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe dd4a98c54832ec6b61160f7c214af65f476cc75659fc3ea0add868373022031e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1103586/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/149493/

Comments