MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecfc86566ed2bb98718943489e2197c59c2d4b3b9b5127622c42cf24dfba80c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecfc86566ed2bb98718943489e2197c59c2d4b3b9b5127622c42cf24dfba80c0
SHA3-384 hash: b4439a61a10a989cfbd081f5ccb6ee0f03d4efaf60c2ff8809ad5b17f5585d9d9e858a68f8caa32352adb64939d5b835
SHA1 hash: 8eaa7511262c6d054fcc7ce569561fb8f7750b9c
MD5 hash: 029bbf0deeb8ea296e8c213f1781ca87
humanhash: hotel-california-foxtrot-nuts
File name:4978_1648048111_1589.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'591'928 bytes
First seen:2022-03-25 07:00:52 UTC
Last seen:2024-07-24 22:43:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f202152ef7611b15765383169e656a1 (4 x RedLineStealer)
ssdeep 49152:dWZFxv+cF0tqkLhapAhbOVOFYc+YHnFcU+zPx+SQLF4FKLn1JA112ON03Yb3:dsfvbWjliobkTc/wMr1ms3Yb
Threatray 1'776 similar samples on MalwareBazaar
TLSH T1D8C5239AE57823F3E117A37DC4D1A61AF3F27042875393AB129487A71E13BD06D3A712
File icon (PE):PE icon
dhash icon 6192a6a6a6a6c401 (17 x RedLineStealer, 11 x PythonStealer, 9 x DCRat)
Reporter JAMESWT_WT
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:Google LLC
Issuer:Google LLC
Algorithm:sha256WithRSAEncryption
Valid from:2022-03-14T00:00:00Z
Valid to:2024-03-14T00:00:00Z
Serial number: 111505a89f16dd26
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: dcc71c04432dc860dd824d5bd9af349aa49d073394be4a9ae9aabf6c50227b2b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/257518/
Detection(s):
SecuriteInfo.com.BAT.Starter.366.21400.6557.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Replacing files
Enabling the 'hidden' option for files in the %temp% directory
Sending a custom TCP request
Sending an HTTP POST request
Using the Windows Management Instrumentation requests
Creating a file
Reading critical registry keys
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/11281/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/623d68cea19c6494128c2db9/reports/252818d7-9d47-4166-b140-44999ef7f504/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ca99de19-261f-4462-ac0d-50307ce0bb43
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/964483
Signature
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 596965 Sample: 4978_1648048111_1589.exe Startdate: 25/03/2022 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for dropped file 2->42 44 5 other signatures 2->44 8 4978_1648048111_1589.exe 8 2->8         started        process3 file4 28 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 8->28 dropped 30 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 8->30 dropped 11 cmd.exe 2 8->11         started        process5 process6 13 5.exe 15 19 11->13         started        17 7z.exe 2 11->17         started        20 7z.exe 3 11->20         started        22 8 other processes 11->22 dnsIp7 32 193.163.203.123, 49779, 49789, 49792 FR-RENATER-LIMOUSINReseauRegionalLimousinEU Denmark 13->32 34 api.ip.sb 13->34 36 192.168.2.1 unknown unknown 13->36 46 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->46 48 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 13->48 50 Tries to harvest and steal browser information (history, passwords, etc) 13->50 52 Tries to steal Crypto Currency Wallets 13->52 24 conhost.exe 13->24         started        26 C:\Users\user\AppData\Local\Temp\...\5.exe, PE32 17->26 dropped file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecfc86566ed2bb98718943489e2197c59c2d4b3b9b5127622c42cf24dfba80c0/
Threat name:
Win64.Trojan.RedLineSteal
Create hunting rule
Status:
Malicious
First seen:
2022-03-25 06:51:40 UTC
File Type:
PE+ (Exe)
Extracted files:
9
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5t6imvto2k5zq4mjinej4imxywoc2sz3tnisoyrmilhsjx52qdaa._file
Verdict:
malicious
Similar samples:
859e64236c7d4720e0a2be0ecc3a289034b2c2ca7b136874dd6bcc649c79d8ba
RedLineStealer
863c3a369f8c38dcc2158166e2c1510b610f7bbf75a77830ffba62a0f14d1327
RedLineStealer
a24880fb0761998edebd4649a3f127f2522dd0b8282c016f1cde70d01aa805c0
RedLineStealer
a651672f98fba458ca8b6861557119c81d12afcb705c457d65dd2b44dcc499fe
RedLineStealer
d1a3eb518cc279036090506722e5754752278934587d8d6c2e6282825a9c5b33
RedLineStealer
d9213d0adeb046eda1ab1551235f3d5f4566acebe327b7e817effccf5f6d9070
RedLineStealer
d9886bd374d41e121835cb726da295b753c5c6307949da904b1cf3b69bc1fcb9
RedLineStealer
+ 1'766 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@mepiks discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220325-htazxsbbg5/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
193.163.203.123:63581
Unpacked files
SH256 hash:
ecfc86566ed2bb98718943489e2197c59c2d4b3b9b5127622c42cf24dfba80c0
MD5 hash:
029bbf0deeb8ea296e8c213f1781ca87
SHA1 hash:
8eaa7511262c6d054fcc7ce569561fb8f7750b9c
Link:
https://www.unpac.me/results/b89f0b73-f84e-4b91-8b6b-a3c3ab4192e3/
Malware family:
RedLine
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ecfc86566ed2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ecfc86566ed2bb98718943489e2197c59c2d4b3b9b5127622c42cf24dfba80c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/257518/

Comments