MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df8082a0727341606afda10b167324b33efd4b4f98f468f53d74b3588257c754. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df8082a0727341606afda10b167324b33efd4b4f98f468f53d74b3588257c754
SHA3-384 hash: 3a3fe29357258497503ac34af144033d685c525bc93d17f4eb70070d4c89677e81904311808eeae8a4b9580d411b81ab
SHA1 hash: 813d1b385dd2f22c419ab3ef7ab994d187371042
MD5 hash: 830ad7410305d9226693e611cce740d9
humanhash: high-south-early-two
File name:df8082a0727341606afda10b167324b33efd4b4f98f46.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:712'704 bytes
First seen:2022-11-04 21:35:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:QsqChpY7xeeF+VvMsd6/L+AJGHV5hajA6EDXW8jOD/gSegqA6/lkw3RRNxNjfOBL:QsqHFejvMsd698/bW77gSeNWwS
TLSH T1FCE42A637518D542EA5C5032A942C4B95BA46CBACAC0713A70E6FF2FE4F3322494DF5E
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f0e1c9dcdaf2dccc (13 x RedLineStealer, 1 x RecordBreaker, 1 x EternityStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
45.15.156.46:31361

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
df8082a0727341606afda10b167324b33efd4b4f98f46.exe
Verdict:
Malicious activity
Analysis date:
2022-11-04 21:37:57 UTC
Tags:
trojan rat redline evasion
Link:
https://app.any.run/tasks/111f83a5-a1d8-4ad4-97ae-f41748c37677

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/328830/
Detection(s):
Can't access file ERROR
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Using the Windows Management Instrumentation requests
Creating a file
Sending a custom TCP request
Creating a window
Reading critical registry keys
Сreating synchronization primitives
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/636585c215611f8d8bf8e3fb/reports/ac73b85f-ca15-4b3c-bf04-3f900c3124db/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7628c73d-fbc3-4e78-b857-66bee229b738
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1105817
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 738482 Sample: df8082a0727341606afda10b167... Startdate: 04/11/2022 Architecture: WINDOWS Score: 100 46 iplogger.org 2->46 48 iplogger.com 2->48 92 Snort IDS alert for network traffic 2->92 94 Malicious sample detected (through community Yara rule) 2->94 96 Antivirus detection for URL or domain 2->96 98 7 other signatures 2->98 9 df8082a0727341606afda10b167324b33efd4b4f98f46.exe 3 2->9         started        signatures3 process4 file5 40 df8082a0727341606a...fd4b4f98f46.exe.log, ASCII 9->40 dropped 100 Writes to foreign memory regions 9->100 102 Allocates memory in foreign processes 9->102 104 Injects a PE file into a foreign processes 9->104 13 vbc.exe 15 21 9->13         started        signatures6 process7 dnsIp8 58 45.15.156.46, 31361, 49698 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 13->58 60 iplogger.com 148.251.234.93, 443, 49699, 49702 HETZNER-ASDE Germany 13->60 62 5 other IPs or domains 13->62 42 C:\Users\user\AppData\Local\Temp\sta8ts.exe, PE32 13->42 dropped 44 C:\Users\user\AppData\Local\Temp\st2ats.exe, PE32 13->44 dropped 116 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->116 118 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->118 120 Tries to steal Crypto Currency Wallets 13->120 18 st2ats.exe 13->18         started        21 sta8ts.exe 13->21         started        24 chrome.exe 15 1 13->24         started        26 2 other processes 13->26 file9 signatures10 process11 dnsIp12 76 Machine Learning detection for dropped file 18->76 78 Writes to foreign memory regions 18->78 80 Allocates memory in foreign processes 18->80 82 Injects a PE file into a foreign processes 18->82 28 InstallUtil.exe 18->28         started        31 InstallUtil.exe 18->31         started        50 109.107.191.169, 34067, 49791 TELEPORT-TV-ASRU Russian Federation 21->50 52 bitbucket.org 21->52 84 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->84 86 Query firmware table information (likely to detect VMs) 21->86 88 Tries to detect sandboxes and other dynamic analysis tools (window names) 21->88 90 4 other signatures 21->90 54 192.168.2.1 unknown unknown 24->54 56 239.255.255.250 unknown Reserved 24->56 34 chrome.exe 24->34         started        36 chrome.exe 26->36         started        38 chrome.exe 26->38         started        signatures13 process14 dnsIp15 106 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 28->106 108 Performs DNS queries to domains with low reputation 28->108 110 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->110 64 jalocliche.xyz 85.239.53.233, 49790, 49792, 49793 RAINBOW-HKRainbownetworklimitedHK Russian Federation 31->64 66 chardhesha.xyz 31->66 68 api.ip.sb 31->68 112 Tries to harvest and steal browser information (history, passwords, etc) 31->112 114 Tries to steal Crypto Currency Wallets 31->114 70 iplogger.org 148.251.234.83, 443, 49715, 49716 HETZNER-ASDE Germany 34->70 72 www.google.com 142.250.203.100, 443, 49710, 49769 GOOGLEUS United States 34->72 74 5 other IPs or domains 34->74 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df8082a0727341606afda10b167324b33efd4b4f98f468f53d74b3588257c754/
Threat name:
ByteCode-MSIL.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-11-04 21:36:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
46
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=36aifidsonawa2x5uefrm4zewm7p2s2ptd2gr5j5oszvrasxy5ka._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:new1104 botnet:usa discovery evasion infostealer persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/221104-1fwzcadbdl/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Uses the VBS compiler for execution
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
RedLine payload
Malware Config
C2 Extraction:
45.15.156.46:31361
jalocliche.xyz:81
chardhesha.xyz:81
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c63cf254-5337-45e0-b058-dff8795a7648
Unpacked files
SH256 hash:
77d89bf656369b55374ff060af866a223122b2f8b524c83bf5bd59ca213e6d24
MD5 hash:
833524cd46a69c684feb912ba4f46b39
SHA1 hash:
bec3d148251f96e585412cc678a5c82a91223add
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/906fb0e1-f562-40e9-8ab4-46c3dea27dd5/
SH256 hash:
df8082a0727341606afda10b167324b33efd4b4f98f468f53d74b3588257c754
MD5 hash:
830ad7410305d9226693e611cce740d9
SHA1 hash:
813d1b385dd2f22c419ab3ef7ab994d187371042
Link:
https://www.unpac.me/results/906fb0e1-f562-40e9-8ab4-46c3dea27dd5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df8082a0727341606afda10b167324b33efd4b4f98f468f53d74b3588257c754

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe df8082a0727341606afda10b167324b33efd4b4f98f468f53d74b3588257c754

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/328830/
  
URLhaus
https://urlhaus.abuse.ch/url/2401247/
  
Delivery method
Distributed via web download

Comments