MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152
SHA3-384 hash: 48f46f71cc881e421dc2e0bdfc5f080d1a821fdd118c230ca4a0e4f885756b1fb723154ec95d4c8c96b089587d12ed6f
SHA1 hash: de5e59cd81f17027d811400bc7d48765e1d55df2
MD5 hash: 0aef3aef127a4f780fc0166e4ed8ebac
humanhash: table-alpha-venus-texas
File name:0aef3aef127a4f780fc0166e4ed8ebac.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:562'176 bytes
First seen:2021-12-20 17:12:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:QXIdYYzhxD+Y/90L6rQdYYvRg1YGu1OaY2Cmw5vEwUnIA/eFJ:QY2WhxDD/yercpn
Threatray 1'711 similar samples on MalwareBazaar
TLSH T10DC4E5383AFA9019F273EF759AD8759BDA6FF6633707A45E205003860B13A81DDD1239
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
18.191.251.199:45097

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
18.191.251.199:45097 https://threatfox.abuse.ch/ioc/278217/

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215519/
Detection(s):
Win.Packed.Generickdz-9916211-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
DNS request
Searching for synchronization primitives
Creating a file
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61c0b9a74ab5c44cbf4a79e2/reports/7d2fc1cd-0db4-4dac-b8e9-54a733be630b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c8636341-3cd3-44b1-958c-2d933edd22c7
Result
Threat name:
Makop Oled RedLine
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/910465
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Connects to many ports of the same IP (likely port scanning)
Creates files in the recycle bin to hide itself
Creates files inside the volume driver (system volume information)
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Disables Windows Defender (via service or powershell)
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Found ransom note / readme
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Execution from Suspicious Folder
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: WannaCry Ransomware
Tries to harvest and steal browser information (history, passwords, etc)
Uses cmd line tools excessively to alter registry or file data
Yara detected Makop ransomware
Yara detected Oled Ransomware
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 542948 Sample: RFAmVep9ut.exe Startdate: 20/12/2021 Architecture: WINDOWS Score: 100 88 Sigma detected: WannaCry Ransomware 2->88 90 Malicious sample detected (through community Yara rule) 2->90 92 Multi AV Scanner detection for submitted file 2->92 94 13 other signatures 2->94 11 RFAmVep9ut.exe 3 2->11         started        15 wbengine.exe 2->15         started        17 vdsldr.exe 2->17         started        19 vds.exe 2->19         started        process3 file4 76 C:\Users\user\AppData\...\RFAmVep9ut.exe.log, ASCII 11->76 dropped 108 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->108 110 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 11->110 112 Disables Windows Defender (via service or powershell) 11->112 114 Injects a PE file into a foreign processes 11->114 21 RFAmVep9ut.exe 15 8 11->21         started        116 Creates files inside the volume driver (system volume information) 15->116 signatures5 process6 dnsIp7 82 18.191.251.199, 45097, 49744 AMAZON-02US United States 21->82 84 github.com 140.82.121.3, 443, 49764, 49767 GITHUBUS United States 21->84 86 raw.githubusercontent.com 185.199.108.133, 443, 49766, 49768 FASTLYUS Netherlands 21->86 72 C:\Windows\Tasks\wmi.exe, PE32 21->72 dropped 74 C:\Windows\Tasks\condition.exe, PE32 21->74 dropped 102 Drops executables to the windows directory (C:\Windows) and starts them 21->102 104 Tries to harvest and steal browser information (history, passwords, etc) 21->104 106 Disables Windows Defender (via service or powershell) 21->106 26 condition.exe 4 21->26         started        28 cmd.exe 1 21->28         started        file8 signatures9 process10 signatures11 31 cmd.exe 26->31         started        34 conhost.exe 26->34         started        118 Uses cmd line tools excessively to alter registry or file data 28->118 120 Disables Windows Defender (via service or powershell) 28->120 36 Dism.exe 28->36         started        39 cmd.exe 1 28->39         started        41 powershell.exe 24 28->41         started        43 2 other processes 28->43 process12 file13 124 Drops executables to the windows directory (C:\Windows) and starts them 31->124 45 wmi.exe 31->45         started        64 C:\Users\user\AppData\...\WimProvider.dll.mui, PE32 36->64 dropped 66 C:\Users\user\AppData\...\VhdProvider.dll.mui, PE32 36->66 dropped 68 C:\Users\user\...\UnattendProvider.dll.mui, PE32 36->68 dropped 70 49 other files (none is malicious) 36->70 dropped 49 DismHost.exe 36->49         started        126 Uses cmd line tools excessively to alter registry or file data 39->126 51 reg.exe 1 39->51         started        signatures14 process15 file16 78 C:\Windows\Tasks\readme-warning.txt, ASCII 45->78 dropped 80 C:\$Recycle.Bin\...\readme-warning.txt, ASCII 45->80 dropped 122 Creates files in the recycle bin to hide itself 45->122 53 cmd.exe 45->53         started        signatures17 process18 signatures19 96 May disable shadow drive data (uses vssadmin) 53->96 98 Deletes shadow drive data (may be related to ransomware) 53->98 100 Deletes the backup plan of Windows 53->100 56 conhost.exe 53->56         started        58 vssadmin.exe 53->58         started        60 wbadmin.exe 53->60         started        62 WMIC.exe 53->62         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-20 17:13:10 UTC
File Type:
PE (.Net Exe)
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=46va3kscz5dpsjuhox2557zlf6kxj34jgibesfjb5cnhkqdiqfja._file
Verdict:
malicious
Similar samples:
1d9e3011367847fa6a2bd799105adfa4915169e4255ed26922669d457300242a
RedLineStealer
530e0002c120d13962f54641655060f420625a3ee39b740dac62a644bda96ede
RedLineStealer
74c5701189877d6ff1cee769cfb34bd211feebbd4ad1e03c4f5c609dffe184ac
RedLineStealer
7d11586c00eeb3c5a62f8924e862f4926e5c0632b1eb9e95008d91a5f689b1eb
RedLineStealer
a2f9f5a099a6b1c2ba6789effefa150aec52c5587e85df9a6963fd03b55d4d57
RedLineStealer
cea9aafffaa9c5b5b5b7a2d8245ef6290b2fb58276a79d8fc9cb22facb9cce15
RedLineStealer
+ 1'701 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:10 discovery evasion infostealer spyware stealer trojan
Link:
https://tria.ge/reports/211220-vreasacbdj/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine Payload
Malware Config
C2 Extraction:
18.191.251.199:45097
Unpacked files
SH256 hash:
3e81ac1556f1c8cac0c884c41fb570cb3321127d64830fb499fc03bf41bba3f6
MD5 hash:
e7165365b15887d34a9bee2e9d63e148
SHA1 hash:
d480714e2aeeb8ad880f01c17ac08a30a81cf91f
Link:
https://www.unpac.me/results/e3817e0e-f75e-4627-ad52-8c645211ca01/
SH256 hash:
e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152
MD5 hash:
0aef3aef127a4f780fc0166e4ed8ebac
SHA1 hash:
de5e59cd81f17027d811400bc7d48765e1d55df2
Link:
https://www.unpac.me/results/e3817e0e-f75e-4627-ad52-8c645211ca01/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e7aa0daa42cf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/215519/

Comments