MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8aa33b99bb248f640363d937986e465239346a7f25f8e8579b92b5c975f38a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8aa33b99bb248f640363d937986e465239346a7f25f8e8579b92b5c975f38a9
SHA3-384 hash: 7d479353592d53bbb33267067722fb178f7eb58dc8d3dd6e6d5b3610346269c475962c98f6a85871c28d4a4f1bf3accb
SHA1 hash: 55ce2341573c2cf780a5212d99e814c12d124d0d
MD5 hash: 201abecf58b4a4653f4665a322b9a573
humanhash: freddie-oranges-winter-video
File name:KRSetp.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:151'552 bytes
First seen:2021-06-15 11:20:53 UTC
Last seen:2021-06-15 11:51:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:4siDKnSLsF0JTlLWgSqvWHWk1PqhA9999/7z:94WYxliEiWk1z
Threatray 233 similar samples on MalwareBazaar
TLSH 37E3B25B0EB09482C11CF67FA0485EFB6671BF3AFD14FE886041619AF4D8E8C6876257
Reporter JAMESWT_WT
Tags:data.exe exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d8a3df5d5ed44873fc091b44a64f98c6c54dae8356d747cddee51b88df9f1d2e
Verdict:
Malicious activity
Analysis date:
2021-06-15 11:19:03 UTC
Tags:
autoit evasion stealer trojan rat redline phishing
Link:
https://app.any.run/tasks/07505aaf-d44f-45bb-abfb-22e3fc7d6921

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37087415.16819.22716.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a process with a hidden window
Sending a custom TCP request
Creating a file
Creating a window
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Deleting a recently created file
Sending an HTTP POST request
Creating a file in the %temp% directory
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a recently created process by context flags manipulation
Forced shutdown of a browser
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a61a6d5-f2db-4f29-8cc6-f618fd020e4e
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/802353
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 434749 Sample: KRSetp.exe Startdate: 15/06/2021 Architecture: WINDOWS Score: 100 85 Multi AV Scanner detection for domain / URL 2->85 87 Found malware configuration 2->87 89 Malicious sample detected (through community Yara rule) 2->89 91 10 other signatures 2->91 7 KRSetp.exe 15 8 2->7         started        12 WinHoster.exe 2->12         started        14 WinHoster.exe 2->14         started        process3 dnsIp4 61 topnewsdesign.xyz 104.21.69.75, 443, 49743 CLOUDFLARENETUS United States 7->61 63 iplogger.org 88.99.66.31, 443, 49749, 49750 HETZNER-ASDE Germany 7->63 65 192.168.2.1 unknown unknown 7->65 49 C:\Users\user\AppData\Roaming\8506541.exe, PE32 7->49 dropped 51 C:\Users\user\AppData\Roaming\7834689.exe, PE32 7->51 dropped 53 C:\Users\user\AppData\Roaming\5191601.exe, PE32 7->53 dropped 55 2 other malicious files 7->55 dropped 93 Detected unpacking (changes PE section rights) 7->93 95 Detected unpacking (overwrites its own PE header) 7->95 97 May check the online IP address of the machine 7->97 99 Performs DNS queries to domains with low reputation 7->99 16 8506541.exe 3 7->16         started        19 7834689.exe 1 4 7->19         started        22 1029662.exe 15 11 7->22         started        25 5191601.exe 14 2 7->25         started        file5 signatures6 process7 dnsIp8 71 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->71 73 Performs DNS queries to domains with low reputation 16->73 75 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 16->75 77 Injects a PE file into a foreign processes 16->77 27 8506541.exe 16->27         started        39 C:\Users\user\AppData\...\WinHoster.exe, PE32 19->39 dropped 79 Multi AV Scanner detection for dropped file 19->79 81 Detected unpacking (changes PE section rights) 19->81 83 Detected unpacking (overwrites its own PE header) 19->83 31 WinHoster.exe 19->31         started        57 videoconvert-download12.xyz 172.67.192.171, 443, 49747 CLOUDFLARENETUS United States 22->57 41 C:\ProgramData\50\vcruntime140.dll, PE32 22->41 dropped 43 C:\ProgramData\50\sqlite3.dll, PE32 22->43 dropped 45 C:\ProgramData\50\softokn3.dll, PE32 22->45 dropped 47 4 other files (none is malicious) 22->47 dropped 33 WerFault.exe 22->33         started        35 WerFault.exe 22->35         started        59 pcfixmy-download-13.xyz 104.21.46.30, 443, 49751 CLOUDFLARENETUS United States 25->59 37 WerFault.exe 25->37         started        file9 signatures10 process11 dnsIp12 67 xalemiaind.xyz 85.192.56.35, 49774, 49776, 49777 DINET-ASRU Russian Federation 27->67 69 api.ip.sb 27->69 101 Tries to harvest and steal browser information (history, passwords, etc) 27->101 103 Tries to steal Crypto Currency Wallets 27->103 105 Detected unpacking (changes PE section rights) 31->105 107 Detected unpacking (overwrites its own PE header) 31->107 109 Tries to evade analysis by execution special instruction which cause usermode exception 33->109 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8aa33b99bb248f640363d937986e465239346a7f25f8e8579b92b5c975f38a9/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-06-12 20:16:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7cvdhom3wjepmqbwhwjxtbxemurzgrvh6jpy5blzxevvzf27hcuq._file
Verdict:
unknown
Similar samples:
102af82a3e7b2d394bac5a80c4f97cdafe9be52bca002e1d824c810c8a760794
RedLineStealer
3d30ffd438512742fc01ca5df9c4b9d0deb9f908ef56e7dd3e284eec904f517d
RedLineStealer
418c5fa990720936d23f83e5bd72b11d4bbf045b33e60efe09e28aa074eac424
RedLineStealer
445d39df326616cbfd206707370348697ee1ad8ffb5ce1edc330afe9bf49266e
RedLineStealer
6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787
RedLineStealer
738108e1651deb6c04e05a4a2680819283433189eff93426a56e834381b5e4b5
RedLineStealer
a7b172d3fb0092b616e486d62a628e6fa09608d9e9a54773bc34fd37f2227a3e
RedLineStealer
a9aa703a747507172df67af14684440e244fbe237507140eacc01726c1c0af13
RedLineStealer
d1597e584fec8eb356aa5c831045b2ce68531e69fe70436fa3ca0d8dd1d90ca7
RedLineStealer
e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37
RedLineStealer
+ 223 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer persistence spyware stealer
Link:
https://tria.ge/reports/210615-akhddfn8ve/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of web browsers
Executes dropped EXE
RedLine
RedLine Payload
Unpacked files
SH256 hash:
9798bbcbf18911c7465a6057aa163d3e1badafab27d2ac90138b5096b516ae5c
MD5 hash:
e60e3f87e7b4a46041c1cdb5ba429830
SHA1 hash:
0a9789352449598d2643b4f1dc803f4e4fe021ec
Link:
https://www.unpac.me/results/4d0144ab-ca3e-459b-a14f-c41670b60853/
SH256 hash:
f8aa33b99bb248f640363d937986e465239346a7f25f8e8579b92b5c975f38a9
MD5 hash:
201abecf58b4a4653f4665a322b9a573
SHA1 hash:
55ce2341573c2cf780a5212d99e814c12d124d0d
Link:
https://www.unpac.me/results/4d0144ab-ca3e-459b-a14f-c41670b60853/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f8aa33b99bb248f640363d937986e465239346a7f25f8e8579b92b5c975f38a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekshen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:Telegram_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Telegram in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/pollo290987/status/1404358946819878912?s=20

Comments