MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd6dee2697bcc5d714a75c7139963f3f13a214fd508d4e67d5962e93b44b7b14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd6dee2697bcc5d714a75c7139963f3f13a214fd508d4e67d5962e93b44b7b14
SHA3-384 hash: 66dcf79a17247f2ec21c2c3f504d19c94b19e3986d5e1462dabd7f344d831b4c9a9eab186dddc04449150a684f42efd5
SHA1 hash: f1c03ba68050021ef731adaeccdc31b40079af5e
MD5 hash: e3bc7ad90612e3d54ef53dbd26669875
humanhash: failed-delaware-paris-jupiter
File name:e3bc7ad90612e3d54ef53dbd26669875.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:25'088 bytes
First seen:2020-10-28 15:25:05 UTC
Last seen:2020-10-28 16:51:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 384:MBvS6i9fBCra75Iow9p0Jy6T1PDjKZOuB/msUme7OgJ7KXkBPtAuNiHu:uq6i9fBCra1Gp0Jy61xOe7JKXkBKuB
TLSH FFB23B21B3FCC336E4EA0B7E42F4C2415171F9566802D74F9E9860A56F73B865E227A3
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/80532/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.58261.28377.6208.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Deleting a recently created file
Reading critical registry keys
Running batch commands
Sending a UDP request
DNS request
Sending a custom TCP request
Launching a process
Creating a file
Sending an HTTP POST request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/515301
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 306760 Sample: LjYuWUk2yX.exe Startdate: 28/10/2020 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected RedLine Stealer 2->42 44 Uses ping.exe to sleep 2->44 46 6 other signatures 2->46 8 LjYuWUk2yX.exe 15 3 2->8         started        process3 dnsIp4 32 a.nruptm.ru 81.177.135.41, 443, 49713 RTCOMM-ASRU Russian Federation 8->32 50 Writes to foreign memory regions 8->50 52 Allocates memory in foreign processes 8->52 54 Injects a PE file into a foreign processes 8->54 12 AddInProcess32.exe 14 23 8->12         started        16 AddInProcess32.exe 8->16         started        18 AddInProcess32.exe 8->18         started        20 AddInProcess32.exe 8->20         started        signatures5 process6 dnsIp7 34 188.119.113.139, 35200, 49719 SERVERIUS-ASNL Russian Federation 12->34 36 WHOIS.RIPE.NET 193.0.6.135, 43, 49727 RIPE-NCC-ASReseauxIPEuropeensNetworkCoordinationCentre Netherlands 12->36 38 7 other IPs or domains 12->38 56 Tries to harvest and steal browser information (history, passwords, etc) 12->56 22 cmd.exe 1 12->22         started        58 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->58 60 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->60 signatures8 process9 dnsIp10 30 127.0.0.1 unknown unknown 22->30 48 Uses ping.exe to sleep 22->48 26 conhost.exe 22->26         started        28 PING.EXE 1 22->28         started        signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd6dee2697bcc5d714a75c7139963f3f13a214fd508d4e67d5962e93b44b7b14/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 15:27:03 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:redline infostealer keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201028-q1z6ntb2g6/
Behaviour
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
RedLine
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe dd6dee2697bcc5d714a75c7139963f3f13a214fd508d4e67d5962e93b44b7b14

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/80532/
  
URLhaus
https://urlhaus.abuse.ch/url/759003/
  
Delivery method
Distributed via web download

Comments