MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f308b421eca9c5e09325bcf0dc44a6dc86bd320f4cf2a569784e878a92352305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 10


Intelligence 10 IOCs 2 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f308b421eca9c5e09325bcf0dc44a6dc86bd320f4cf2a569784e878a92352305
SHA3-384 hash: bb0dc1522805752ad9b5d2e035c60df9592ce0addaa028bcfb43c2274bebfb3a7e8867ac3bf6086cbfd1d478df792b72
SHA1 hash: fc1dbbe42fb144d204274bf1ec52d1c1ec383c0d
MD5 hash: 52a6af948cb128ee72f7ffd839c48dbb
humanhash: autumn-blue-lactose-robert
File name:52a6af948cb128ee72f7ffd839c48dbb.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'071'392 bytes
First seen:2022-02-18 06:06:10 UTC
Last seen:2022-02-18 07:56:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e13ec50c97e03d8d4a2fd9d007c624b (1 x RedLineStealer)
ssdeep 24576:a6z1aXoDWoLphs/OZbc/oY4jRNGsDKoSvD:fBsoyoXrbcgNSvD
Threatray 198 similar samples on MalwareBazaar
TLSH T16635EF2537867037D9A797768AD286F87C22AC2578C6A6133F71FD1F38B50D0E636206
File icon (PE):PE icon
dhash icon e4fc3ccccceca494 (1 x RedLineStealer)
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
5.189.201.182:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.189.201.182:81 https://threatfox.abuse.ch/ioc/388509/
185.101.139.14:80 https://threatfox.abuse.ch/ioc/388540/

Intelligence

File Origin
# of uploads :
2
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/242433/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.51852.1169.19846.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Launching a process
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autorun exploit overlay packed virus
Link:
https://www.filescan.io/uploads/620f3789ac8ad0468b4f6732/reports/e2e871c8-8491-41fb-904a-0adfd0b8dd68/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/942030
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Performs DNS queries to domains with low reputation
Sigma detected: File Created with System Process Name
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 574508 Sample: BF6kKvBYuM.exe Startdate: 18/02/2022 Architecture: WINDOWS Score: 100 46 karinianise.xyz 2->46 48 bonezarisor.xyz 2->48 50 api.ip.sb 2->50 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for URL or domain 2->58 60 11 other signatures 2->60 8 BF6kKvBYuM.exe 8 2->8         started        13 dllhost.exe 2->13         started        15 dllhost.exe 2->15         started        signatures3 process4 dnsIp5 52 duoproc.net 185.18.52.211, 49746, 49747, 49748 WORLDSTREAMNL Spain 8->52 34 C:\Users\user\AppData\Local\Temp\L1J98.exe, PE32 8->34 dropped 36 C:\Users\user\AppData\Local\Temp\8DJ45.exe, PE32 8->36 dropped 38 C:\Users\user\AppData\...\5B5K3I2AI1BE630.exe, PE32+ 8->38 dropped 40 3 other malicious files 8->40 dropped 74 Creates HTML files with .exe extension (expired dropper behavior) 8->74 76 Tries to evade analysis by execution special instruction which cause usermode exception 8->76 78 Hides threads from debuggers 8->78 80 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->80 17 1H5F8.exe 16 4 8->17         started        22 3G52D.exe 2 8->22         started        24 L1J98.exe 2 8->24         started        26 4 other processes 8->26 82 Detected unpacking (changes PE section rights) 13->82 84 Tries to detect sandboxes and other dynamic analysis tools (window names) 13->84 86 Machine Learning detection for dropped file 13->86 file6 signatures7 process8 dnsIp9 42 yandex.ru 5.255.255.55, 443, 49758 YANDEXRU Russian Federation 17->42 30 C:\Users\user\AppData\Roaming\...\dllhost.exe, PE32 17->30 dropped 62 Multi AV Scanner detection for dropped file 17->62 64 Detected unpacking (changes PE section rights) 17->64 66 Machine Learning detection for dropped file 17->66 68 Tries to evade analysis by execution special instruction which cause usermode exception 22->68 70 Hides threads from debuggers 22->70 44 iplogger.org 148.251.234.83, 443, 49763 HETZNER-ASDE Germany 26->44 32 C:\Users\user\AppData\Local\Temp\pmo08.PL, PE32 26->32 dropped 72 May check the online IP address of the machine 26->72 28 regsvr32.exe 26->28         started        file10 signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f308b421eca9c5e09325bcf0dc44a6dc86bd320f4cf2a569784e878a92352305/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-16 03:53:00 UTC
File Type:
PE (Exe)
Extracted files:
94
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6meliipmvhc6bezfxtynyrfg3sdl2mqpjtzkk2lyj2dyvervemcq._file
Verdict:
malicious
Similar samples:
1fa8a0ee1f1621305a2e7063c6108d81a136f363d86e067ae9607b104059259b
RedLineStealer
264896379166e6b349462dd06613a2a71f47316815256eb71f57aa4f11d9980c
RedLineStealer
71f2ca63111e328be5ab5d88978b8d41bd59735382cac9131500c079ef91358e
RedLineStealer
8a11790a57ada815e5fcb19b62fb18d2ae9f22a498f1a46b1677d3485b5c235c
RedLineStealer
9617dc1938ef945ab37282b04d7d083412485c144dd60c96d68f508da8a1a7c1
RedLineStealer
9bc3b1788041f0f94ec1c8602d4ebc97b7d06a276ba9287042dc16e4ac2e7f52
RedLineStealer
aa18910412099ecf87968e2cf4b18088ecfe5311ace3a8f7b70612ce292063f7
RedLineStealer
ce07198dda417c585ac5ce50c7c5376e9e48ec025dd2b6d06a210c0a72ff2935
RedLineStealer
f1a10725589836a8b8959f7ceb298f84b1e5a9736fe97f32a816028aaff55001
RedLineStealer
fbe27506c78a9c364bdadfbdbcfe6c60a436aa3c06c0d83494ef4edda50cd93e
RedLineStealer
+ 188 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/220218-gvbr6sbec2/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
114d18af276a56781b3b0e95b6c99b381039f2c6cb914edbfaff3767428b88e7
MD5 hash:
07c8c8aab948ac46ce8a3fbe6b915153
SHA1 hash:
7963ab0a3988671c0a65a6470b5bdf90a131f45e
Link:
https://www.unpac.me/results/17eb66ed-ab52-4135-9461-61a4798c9e3c/
SH256 hash:
f308b421eca9c5e09325bcf0dc44a6dc86bd320f4cf2a569784e878a92352305
MD5 hash:
52a6af948cb128ee72f7ffd839c48dbb
SHA1 hash:
fc1dbbe42fb144d204274bf1ec52d1c1ec383c0d
Link:
https://www.unpac.me/results/17eb66ed-ab52-4135-9461-61a4798c9e3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f308b421eca9c5e09325bcf0dc44a6dc86bd320f4cf2a569784e878a92352305

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/242433/

Comments