MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7708c99c5e08993335b8a6ee65062535d8b2e5298fbecc62a5601817a3d9b2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7708c99c5e08993335b8a6ee65062535d8b2e5298fbecc62a5601817a3d9b2f
SHA3-384 hash: ab8aaf03b256b3d7a336b04f1ad343bba256ee128b2282328d365525c8f6b12a20614a0d52eba0e596034a8d8efaddd9
SHA1 hash: ee2c6ebfb6e876b7b5ac6a1fc056180b87d3f7dd
MD5 hash: 5d0aa962e5f1fb0168bc784795a7d1ab
humanhash: pasta-asparagus-twenty-avocado
File name:5d0aa962e5f1fb0168bc784795a7d1ab.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:4'537'344 bytes
First seen:2022-02-12 17:20:14 UTC
Last seen:2022-02-12 18:47:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7dc28ef949f54ad98c715895ecc34cff (79 x RedLineStealer, 2 x Formbook)
ssdeep 98304:HmsE9L/GGLpWvYpQVc5dF1bAP5EVQdy5WORJ5P41yJbdACO:Hmd9SGLpRmVcTF1bACidSVRjP41yJbC1
Threatray 1'006 similar samples on MalwareBazaar
TLSH T18426333D13F578C9CD4D29B232F5509B676EECB249D4B49023AF822A2D3E58737846D4
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
185.233.200.90:17645

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.233.200.90:17645 https://threatfox.abuse.ch/ioc/387211/

Intelligence

File Origin
# of uploads :
2
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/241091/
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
DNS request
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Running batch commands
Creating a process with a hidden window
Stealing user critical data
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6207ec8154047500bb473bd7/reports/824db06b-3d2b-4ed9-a62a-46b6b6535bbc/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cd143fb0-d8a6-4fe9-9739-323a8794c865
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/938825
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to many ports of the same IP (likely port scanning)
Detected VMProtect packer
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 571303 Sample: PZqKFyAF8P.exe Startdate: 12/02/2022 Architecture: WINDOWS Score: 100 62 Multi AV Scanner detection for domain / URL 2->62 64 Found malware configuration 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 7 other signatures 2->68 9 PZqKFyAF8P.exe 1 2->9         started        12 services32.exe 2->12         started        process3 signatures4 78 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->78 80 Writes to foreign memory regions 9->80 82 Allocates memory in foreign processes 9->82 88 2 other signatures 9->88 14 AppLaunch.exe 15 7 9->14         started        19 conhost.exe 9->19         started        84 Antivirus detection for dropped file 12->84 86 Machine Learning detection for dropped file 12->86 process5 dnsIp6 50 185.233.200.90, 17645, 49772 SUPERSERVERSDATACENTERRU Russian Federation 14->50 52 dl.uploadgram.me 176.9.247.226, 443, 49810 HETZNER-ASDE Germany 14->52 48 C:\Users\user\AppData\Local\Temp\fl.exe, PE32+ 14->48 dropped 54 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->54 56 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->56 58 Tries to harvest and steal browser information (history, passwords, etc) 14->58 60 Tries to steal Crypto Currency Wallets 14->60 21 fl.exe 4 14->21         started        file7 signatures8 process9 file10 46 C:\Windows\System32\services32.exe, PE32+ 21->46 dropped 70 Antivirus detection for dropped file 21->70 72 Multi AV Scanner detection for dropped file 21->72 74 Machine Learning detection for dropped file 21->74 76 Adds a directory exclusion to Windows Defender 21->76 25 cmd.exe 1 21->25         started        28 cmd.exe 1 21->28         started        30 cmd.exe 1 21->30         started        signatures11 process12 signatures13 90 Uses schtasks.exe or at.exe to add and modify task schedules 25->90 92 Adds a directory exclusion to Windows Defender 25->92 32 powershell.exe 23 25->32         started        34 conhost.exe 25->34         started        36 powershell.exe 25->36         started        94 Drops executables to the windows directory (C:\Windows) and starts them 28->94 38 conhost.exe 28->38         started        40 services32.exe 28->40         started        42 conhost.exe 30->42         started        44 schtasks.exe 1 30->44         started        process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7708c99c5e08993335b8a6ee65062535d8b2e5298fbecc62a5601817a3d9b2f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-02-12 17:21:15 UTC
File Type:
PE (Exe)
AV detection:
24 of 42 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=65yizgof4cezgm23rjxomudcknoywlsstd56zrrkkyayc6r5tmxq._file
Verdict:
malicious
Similar samples:
2c7e8a9b546f7c133469fabcfc200e5ab79da84ffa180fda9e088bc5476af860
RedLineStealer
374ec0de5ab31bc54adc80e494194f0070a78839701d19b73b27ca605f05c768
RedLineStealer
479e5e3f4b38759f6a9b5f16565ce5e416ca3609f6b138b87ae2ac3740edac5c
RedLineStealer
56d80b8ecdf299745ae22e2c2849bc285685551686e98149e3c01483d93ca7e5
RedLineStealer
790b75e1d50978e41ae57a87008b3d1922d3efd15924b59a2a0967f29abdab8a
RedLineStealer
b03f5bd449dbd6441f14720cd78dc280580a998842675cec12b7d1a840c67932
RedLineStealer
bd02bb93378748b445190e1e980881f77b0d6ed80d46f1a43211f34eaf305b90
RedLineStealer
d2d63e8749f44493b88d1c4de830a37adfcdbbc0e7249a799679020310c6a48a
RedLineStealer
d7e79c2a5bc37f841e507770e28242740f3b2e076e45a4b5246ae0d1885692b8
RedLineStealer
+ 996 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220212-vwzsaaegfj/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
fc9c6ca1105f47554f8c5a246f617ef554f56075efe8fda117970725d0071294
MD5 hash:
e505fbc14f95db228f04f0f3f2af4b0c
SHA1 hash:
439c056318edc87fc20ecf03b3783a3152e9a15e
Link:
https://www.unpac.me/results/4cc6135e-0c68-40eb-ad80-5e7adfb09741/
SH256 hash:
b58aa4236298b59406c82ce9ce98cea21e5ded2b97ea8e948b8512005061588b
MD5 hash:
157b8f5f22c1c263505b2ed1d98e7c86
SHA1 hash:
a4132417137db6a3c8363288ede07ed43f406030
Link:
https://www.unpac.me/results/4cc6135e-0c68-40eb-ad80-5e7adfb09741/
SH256 hash:
f7708c99c5e08993335b8a6ee65062535d8b2e5298fbecc62a5601817a3d9b2f
MD5 hash:
5d0aa962e5f1fb0168bc784795a7d1ab
SHA1 hash:
ee2c6ebfb6e876b7b5ac6a1fc056180b87d3f7dd
Link:
https://www.unpac.me/results/4cc6135e-0c68-40eb-ad80-5e7adfb09741/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f7708c99c5e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:downloader_macros
Create hunting rule
Author:ddvvmmzz
Description:downloader macros
Rule name:exec_macros
Create hunting rule
Author:ddvvmmzz
Description:exec macros
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:obfuscate_macros
Create hunting rule
Author:ddvvmmzz
Description:obfuscate macros
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe f7708c99c5e08993335b8a6ee65062535d8b2e5298fbecc62a5601817a3d9b2f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2007753/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/241091/

Comments