MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 12

Intelligence 12 IOCs YARA 31 File information Comments

SHA256 hash:	f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7
SHA3-384 hash:	88a7ea7b9c76ef0ab23da008a6e32fb6bcd037dd2f8bd137569d8b79ced9cf858d69413667e921641141e72cda9fd8aa
SHA1 hash:	625b249b94945eb2dda93139831f9197999b1391
MD5 hash:	d2a9d9e182178473cbd9f1e018f93efa
humanhash:	butter-single-may-music
File name:	winPEASx64.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	2'028'544 bytes
First seen:	2023-08-20 21:15:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:sAEhJHs87s26KsOKFdA/JXUKi/oXzQub+Bft705gsXwD:sAnvOcGX6gNaP705g
Threatray	19 similar samples on MalwareBazaar
TLSH	T12B95390077E88B21E2FA8B38A87411018776F963D772D74E328C95794FB3744AC957AB
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	ULTRAFRAUD
Tags:	exe Redline RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

313

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

winPEASx64.exe

Verdict:

Malicious activity

Analysis date:

2023-08-20 21:18:23 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4d2f1d54-8053-4823-aec4-f0d00d2f7b0d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/443850/

Detection(s):

Win.Worm.VB-698

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Creating a file

Sending a custom TCP request

Launching a process

Creating a window

Searching for synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

91%

Tags:

advpack anti-debug anti-vm appvlp at atbroker bash bginfo bitsadmin cdb certutil cl_invocation cl_mutexverifiers cmd cmdkey cmstp comsvcs control csc cscript csi data desktopimgdownldr devtoolslauncher dfsvc diskshadow dnscmd dnx dotnet dxcap esentutl evasive eventvwr expand explorer extexport extrac32 findstr fingerprint forfiles ftp gfxdownloadwrapper gpscript hacktool hh ie4uinit ieadvpack ieaframe ieexec ilasm infdefaultinstall installutil jsc lolbin makecab manage-bde mavinject mftrace microsoft mmc msbuild msconfig msdeploy msdt mshta mshtml msiexec msxsl net netsh ntdsutil odbcconf pcalua pcwrun pcwutl pester presentationhost print psr pubprn rasautou rcsi reg regasm regedit regini register-cimprovider regsvcs regsvr32 remote replace rpcping rundll32 runonce runscripthelper sc schtasks scriptrunner setupapi shdocvw shell32 sqldumper sqlps sqltoolsps squirrel stealer syncappvpublishingserver syssetup te tracker tttracer update url vbc verclsid vsjitdebugger wab winrm wmic wscript wsl wsreset xwizard zipfldr

Link:

https://www.filescan.io/uploads/64e28293a29d57e20388043d/reports/ad33b382-c0d0-4c4f-a92b-cc0e3dc12b95/overview

Verdict:

Malicious

Labled as:

IL:Trojan.MSILMamut

Link:

https://www.hybrid-analysis.com/sample/f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/8cc8a941-1080-45f0-9053-e3854390a1eb

Result

Threat name:

PEASS HackTool

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1294183

Signature

Accesses ntoskrnl, likely to find offsets for exploits

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive printer information (via WMI, Win32_Printer, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Queries sensitive share information (via WMI, WIN32_SHARE, often done to detect sandboxes)

Queries sensitive share information (via WMI, Win32_Share, often done to detect virtual machines)

Sigma detected: Capture Wi-Fi password

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Uses netsh to modify the Windows network and firewall settings

Very long command line found

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected PEASS HackTool

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7/

Threat name:

ByteCode-MSIL.Trojan.Mamut

Status:

Malicious

First seen:

2023-06-29 15:11:59 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

23 of 38 (60.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7d74eutznb2o6npr3j56pj7lbamql6aympg2m42rhkscf7pjxdlq._file

Verdict:

malicious

RedLineStealer

425c0e99221b064d1577ac907a4803d14f4e67a305742aa2c1e80382b967831b

RedLineStealer

623e57f2138f869c8a093760721a1116489ff00099237d3942d9bf8ebe91f55c

RedLineStealer

7480bd6a54b0197851bc35b0e4b7a330336348c0ecaa4f2f0c67f28c16a7488c

RedLineStealer

a290ce75c6c6b37af077b72dc9c2c347a2eede4fafa6551387fa8469539409c7

RedLineStealer

af9fe480abc56cf1e1354eb243ec9f5bee9cac0d75df38249d1c64236132ceab

RedLineStealer

b0409e5acf0d927f046c33befc48b2653ad0ee098e2d4a5764eb9af8126e539f

RedLineStealer

e4492142e62dce45138b0f0c6c93032c02c2c1a2b413ad6d1c8c1d77c803f8c3

RedLineStealer

+ 9 additional samples on MalwareBazaar

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline infostealer spyware stealer

Link:

https://tria.ge/reports/230820-z4frlahd55/

Behaviour

Gathers system information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Enumerates connected drives

Reads user/profile data of web browsers

RedLine

Unpacked files

SH256 hash:

f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7

MD5 hash:

d2a9d9e182178473cbd9f1e018f93efa

SHA1 hash:

625b249b94945eb2dda93139831f9197999b1391

Link:

https://www.unpac.me/results/8d4679f4-2c90-4c94-8600-f68aa2478384/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f8ffc2527968/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects .NET red/black-team tools via typelibguid
Reference:	https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite

Rule name:	hunt_credaccess_iis_xor Create hunting rule
Author:	SBousseaden
Description:	hunt for strings related to iis credential access

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing URLs to raw contents of a Github gist

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_References_SecTools Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many IR and analysis tools

Rule name:	INDICATOR_TOOL_PWS_SharpWeb Create hunting rule
Author:	ditekSHen
Description:	detects all versions of the browser password dumping .NET tool, SharpWeb.

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Windows_Hacktool_Seatbelt_674fd535 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Hacktool_WinPEAS_ng_23fee092 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File analysis module

Rule name:	Windows_Hacktool_WinPEAS_ng_413caa6b Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, event module

Rule name:	Windows_Hacktool_WinPEAS_ng_4a9b9603 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Services info module

Rule name:	Windows_Hacktool_WinPEAS_ng_4db2c852 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, System info module

Rule name:	Windows_Hacktool_WinPEAS_ng_57587f8c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Network module

Rule name:	Windows_Hacktool_WinPEAS_ng_66197d54 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, application module

Rule name:	Windows_Hacktool_WinPEAS_ng_861d3264 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File Info module

Rule name:	Windows_Hacktool_WinPEAS_ng_b6bb3e7c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Windows credentials module

Rule name:	Windows_Hacktool_WinPEAS_ng_bcedc8b2 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, User info module

Rule name:	Windows_Hacktool_WinPEAS_ng_cae025b1 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Process info module

Rule name:	Windows_Hacktool_WinPEAS_ng_e8ed269c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, checks module