MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e65fd3c094cf31498e3598fb1cb94786688178280becedad16aa41f8509294d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs 2 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e65fd3c094cf31498e3598fb1cb94786688178280becedad16aa41f8509294d2
SHA3-384 hash: 8feacc63256e1a11e806deec372b8191c221303c172b5b0248b4844b3864ee1effb9fde7a6a47bc13942d7224d04fdbe
SHA1 hash: f263d22946ac11259236e4f0f95b6dc4699f789d
MD5 hash: bd2b299211b76045b24b9c423459bdc7
humanhash: michigan-romeo-california-maine
File name:bd2b299211b76045b24b9c423459bdc7.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'736'880 bytes
First seen:2022-02-01 17:06:10 UTC
Last seen:2022-02-01 19:10:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 41304e4befbbd8a63ad6ec59f252160b (56 x RedLineStealer, 4 x RaccoonStealer, 2 x CoinMiner)
ssdeep 49152:y4+Vv2c3uIVHaF4dEhjoM5lvzGnxrNQRa+BWwadzkSgcqVQN+42MPuyunlLc+0p3:hQh5DuFddKCdM4s3ZGlwT7F
Threatray 1'012 similar samples on MalwareBazaar
TLSH T14B06337B3ED8EA59C2576AF12A9EEC6ACF921415B4F4B753710888110C788F18BE51CF
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://141.94.188.141/sqlDatalifegeoTest/8multiBase/2SqlTrack/Request/PollDlemariadb2/request/packetTemporaryUniversal5/Provider/base/Vmeternalprotect/Sqlwordpresscentraldownloads.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://141.94.188.141/sqlDatalifegeoTest/8multiBase/2SqlTrack/Request/PollDlemariadb2/request/packetTemporaryUniversal5/Provider/base/Vmeternalprotect/Sqlwordpresscentraldownloads.php https://threatfox.abuse.ch/ioc/373996/
51.178.13.102:8324 https://threatfox.abuse.ch/ioc/373997/

Intelligence

File Origin
# of uploads :
2
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/229268/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Launching the default Windows debugger (dwwin.exe)
Searching for the window
DNS request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Сreating synchronization primitives
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Searching for analyzing tools
Running batch commands
Creating a process with a hidden window
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61f968c26d25ac9e79f6c82e/reports/7a146ee3-bd1e-4d8e-8394-4c999aea1d87/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/59a2a200-1fc5-4d5d-9ecf-7684444b76ec
Result
Threat name:
DCRat RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/931883
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Connects to a pastebin service (likely for C&C)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Creates processes via WMI
Detected unpacking (changes PE section rights)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: File Created with System Process Name
Sigma detected: Powershell Defender Exclusion
Sigma detected: Schedule system process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected DCRat
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 564364 Sample: p0nHuwR4Rz.exe Startdate: 01/02/2022 Architecture: WINDOWS Score: 100 56 pastebin.com 2->56 62 Malicious sample detected (through community Yara rule) 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 14 other signatures 2->68 10 p0nHuwR4Rz.exe 2->10         started        13 WWWhmCsqXPNcfjggi.exe 2->13         started        15 WmiPrvSE.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 signatures5 86 Writes to foreign memory regions 10->86 88 Allocates memory in foreign processes 10->88 90 Injects a PE file into a foreign processes 10->90 19 AppLaunch.exe 15 7 10->19         started        24 WerFault.exe 23 9 10->24         started        92 Multi AV Scanner detection for dropped file 13->92 94 Detected unpacking (changes PE section rights) 13->94 96 Tries to detect sandboxes and other dynamic analysis tools (window names) 13->96 98 Tries to evade analysis by execution special instruction which cause usermode exception 13->98 100 Uses schtasks.exe or at.exe to add and modify task schedules 15->100 26 schtasks.exe 15->26         started        28 schtasks.exe 15->28         started        30 schtasks.exe 15->30         started        32 5 other processes 15->32 102 Hides threads from debuggers 17->102 process6 dnsIp7 58 135.181.141.214, 11552, 49789 HETZNER-ASDE Germany 19->58 60 transfer.sh 144.76.136.153, 443, 49799 HETZNER-ASDE Germany 19->60 52 C:\Users\user\AppData\...\services32.exe, MS-DOS 19->52 dropped 78 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->78 80 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 19->80 82 Tries to harvest and steal browser information (history, passwords, etc) 19->82 84 Tries to steal Crypto Currency Wallets 19->84 34 services32.exe 15 24 19->34         started        54 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 24->54 dropped file8 signatures9 process10 file11 44 C:\Windows\SystemApps\...\SearchUI.exe, MS-DOS 34->44 dropped 46 C:\Windows\SysWOW64\wbem\...\WmiPrvSE.exe, MS-DOS 34->46 dropped 48 C:\Windows\SysWOW64\rdvgumd32\UsoClient.exe, MS-DOS 34->48 dropped 50 5 other malicious files 34->50 dropped 70 Multi AV Scanner detection for dropped file 34->70 72 Detected unpacking (changes PE section rights) 34->72 74 Creates an undocumented autostart registry key 34->74 76 8 other signatures 34->76 38 powershell.exe 34->38         started        40 powershell.exe 34->40         started        signatures12 process13 process14 42 conhost.exe 38->42         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e65fd3c094cf31498e3598fb1cb94786688178280becedad16aa41f8509294d2/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 17:07:19 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zp5hqeuz4yutdrvtd5rzokhqzuic6bibpwo3liwvja7quesstja._file
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Similar samples:
06694768182079f742731e4bc2f6c0ffc012417020d04cd798cb8df4f8919f11
RedLineStealer
237e2e782486d84990697453d8d9498662ac491fbdeb56de82ff8fe09f6d4ed2
RedLineStealer
44e612077d6910fcd7524c6c87029aff62842eef075f0d6061cf4b84a677df30
RedLineStealer
885b5563d73104ef4a5694314b6d71f6526ff9a5fafde8daa7ae7bb6ecd8d8c0
RedLineStealer
92658a69d2939c08c0b2e75389b34b787da9c32c38742827f8bd85ccb549efc9
RedLineStealer
b17e3d464b920c10cb0ceeca0ae9eed030863ddc4233d03ab1ab0f01b58bb92b
RedLineStealer
bfbb5f477e58c173f83ab157415782b680694c9ba43d20bef89dda58bc840c06
RedLineStealer
cfe1a9cedf12e5c01c4727d0b12de8ccecf696a64bf895daf2b71e4131f1e1de
RedLineStealer
e1c74447881f8150767a7567a159efa3c1b06cf976618241c0f81f9bab684f36
RedLineStealer
+ 1'002 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220201-vmze6aabg4/
Unpacked files
SH256 hash:
dcd7264706384c940798adcfc13552e0fd2d78c7f4b9a475c6205e4f04b1d955
MD5 hash:
15e12cae449527b1af5253e14571f17b
SHA1 hash:
1fd8f92a6e3ec3c4cf273bc7967c592351775de9
Link:
https://www.unpac.me/results/ea0435d3-325d-4e43-8ff2-387a604b3557/
SH256 hash:
e65fd3c094cf31498e3598fb1cb94786688178280becedad16aa41f8509294d2
MD5 hash:
bd2b299211b76045b24b9c423459bdc7
SHA1 hash:
f263d22946ac11259236e4f0f95b6dc4699f789d
Link:
https://www.unpac.me/results/ea0435d3-325d-4e43-8ff2-387a604b3557/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e65fd3c094cf31498e3598fb1cb94786688178280becedad16aa41f8509294d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe e65fd3c094cf31498e3598fb1cb94786688178280becedad16aa41f8509294d2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2021536/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/229268/

Comments