MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a
SHA3-384 hash: 7b489c7bf5bf7cbf940dcf238ab5bb9ea37336f182709650ff8438e5528a50fe4afc0d79767420f55595db3e43a055be
SHA1 hash: 837bfd10d70113330b2e00a1f12e99c4b0065d38
MD5 hash: b8371590264db62ecbba4b7f481a21a8
humanhash: sixteen-autumn-november-william
File name:b8371590264db62ecbba4b7f481a21a8
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:627'616 bytes
First seen:2021-07-22 09:36:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash caa5e6a2892587c2324418efee31c648 (9 x RedLineStealer, 1 x RemoteManipulator, 1 x RaccoonStealer)
ssdeep 12288:37iuUvUF2JxjnxXAHbcbzlarx98lR1omCAIEwQbbC+3q99:37iuUvFjxXjgM4mCbEwQbbC+3q99
Threatray 937 similar samples on MalwareBazaar
TLSH T111D4F15B43934FCAD0827FF866A9D37B4B3DADB0F8A259AD5174ECAE296C4C506C0113
dhash icon 71cc8c4d61eacc70 (1 x RedLineStealer)
Reporter zbetcheckin
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b8371590264db62ecbba4b7f481a21a8
Verdict:
No threats detected
Analysis date:
2021-07-22 09:40:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c98f5837-cef2-4d02-a893-ee5ae1d7c268

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173270/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37274373.23110.10871.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c33d9eb-4f27-4391-a6c6-bdfe25715dfe
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/820045
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample or dropped binary is a compiled AutoHotkey binary
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 452456 Sample: Nb2HQZZDIf Startdate: 22/07/2021 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected RedLine Stealer 2->51 53 8 other signatures 2->53 8 Nb2HQZZDIf.exe 14 2->8         started        process3 dnsIp4 41 iplogger.org 88.99.66.31, 443, 49714 HETZNER-ASDE Germany 8->41 43 is.gd 104.25.233.53, 443, 49715 CLOUDFLARENETUS United States 8->43 45 4 other IPs or domains 8->45 29 C:\Users\user\AppData\Roaming\1234.exe, PE32 8->29 dropped 65 Detected unpacking (changes PE section rights) 8->65 67 May check the online IP address of the machine 8->67 69 Sample or dropped binary is a compiled AutoHotkey binary 8->69 13 1234.exe 3 8->13         started        file5 signatures6 process7 signatures8 71 Multi AV Scanner detection for dropped file 13->71 73 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 13->73 75 Performs DNS queries to domains with low reputation 13->75 77 2 other signatures 13->77 16 1234.exe 15 34 13->16         started        21 1234.exe 13->21         started        process9 dnsIp10 31 yspasenana.xyz 212.224.105.105, 49742, 49744, 49745 DE-FIRSTCOLOwwwfirst-colonetDE Germany 16->31 33 api.ip.sb 16->33 35 6 other IPs or domains 16->35 27 C:\Users\user\AppData\Local\Temp\srvs.exe, PE32 16->27 dropped 55 Tries to steal Crypto Currency Wallets 16->55 23 srvs.exe 14 30 16->23         started        file11 signatures12 process13 dnsIp14 37 api.ip.sb 23->37 39 5.149.255.203, 32800, 49751, 49753 HZ-NL-ASGB United Kingdom 23->39 57 Multi AV Scanner detection for dropped file 23->57 59 Detected unpacking (changes PE section rights) 23->59 61 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->61 63 8 other signatures 23->63 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-07-22 00:47:25 UTC
AV detection:
7 of 28 (25.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
01469064718c89b6853365f1c7008c72ccd6a1ecb88a52cfcf82880e39dd0358
RedLineStealer
0ebab35c1d6c8bdfc810aa740f9038ce35e578d294c70df70686a3a3082d8332
RedLineStealer
3cce75ee3c597c77dc463f1769ec04cee91b29761fa4497bc7fffd8e3712cbe7
RedLineStealer
58813f984233cfb9eef1c9abefa7f58e96989dd9d6ebd903d40dc2cf3d56c5e8
RedLineStealer
593f9422a79559ab792b98a272ebd5db883b8a85f34de6a6f05f1c900b221dc5
RedLineStealer
937636dcc1943a63556e24db2fe6e9922d77f2999e4cd747151f70d5def03d4c
RedLineStealer
9f270ac39c512c05aeb9e502738dbbc438a6f95596ec041333b7ae7e334e9c2b
RedLineStealer
b64b8d6ed783256668905a1347aabd325abd166ef465509e82e7c4e8c3d00166
RedLineStealer
ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96
RedLineStealer
fc1c966dd0ac73c1e2aae4287b1480ba9d27d01accc069a9a69d2a4fc9f1a6a9
RedLineStealer
+ 927 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:world discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210722-6bhwxy8vba/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
Malware Config
C2 Extraction:
yspasenana.xyz:80
Unpacked files
SH256 hash:
fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a
MD5 hash:
b8371590264db62ecbba4b7f481a21a8
SHA1 hash:
837bfd10d70113330b2e00a1f12e99c4b0065d38
Link:
https://www.unpac.me/results/6ff82040-662f-41e2-8c65-fdd45078a15f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1473105/
Cape
Cape
https://www.capesandbox.com/analysis/173270/

Comments


Avatar
zbet commented on 2021-07-22 09:36:39 UTC

url : hxxp://installcube.online/faster4pc.exe