MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf
SHA3-384 hash: 12b7c81ebf18f4d7d2be402d850aedab85c1e066b98004bd08c36bfebca7cd37e291512f8e4bf7fef92f327bcdfa2a82
SHA1 hash: f9fd3568f5a131b44df80212aa6080251a36c6b9
MD5 hash: a0b683676361fd47b3a285abf785d0b8
humanhash: may-spaghetti-quiet-fruit
File name:a0b683676361fd47b3a285abf785d0b8.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:432'056 bytes
First seen:2021-10-31 07:42:35 UTC
Last seen:2021-10-31 08:53:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:JPcGXfZfZYQAfX53xs0C7NVZEPiuE3ttkzJeKQBnGMgoLRpymZB04u5nQNe1cydN:mG9ZYQk5BsZNfEPEzqugyvQ4FuL
Threatray 1'259 similar samples on MalwareBazaar
TLSH T18D9423A72374963AE6A7C2B0458960C583FA71523571EBA35DA4C2CC5CC730B9E4D93F
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a0b683676361fd47b3a285abf785d0b8.exe
Verdict:
Malicious activity
Analysis date:
2021-10-31 08:00:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/572f68d4-489a-4e29-b073-a95520e0f8a1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.IL.Trojan.MSILZilla.8215.19394.15393.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/79ee3099-de3f-4e91-9682-3cb8bdd72b8d
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879965
Signature
Adds a directory exclusion to Windows Defender
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspect Svchost Activity
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected AntiVM3
Yara detected RedLine Stealer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 512399 Sample: VuMhXFFSwX.exe Startdate: 31/10/2021 Architecture: WINDOWS Score: 100 53 127.0.0.1 unknown unknown 2->53 67 Multi AV Scanner detection for submitted file 2->67 69 Yara detected UAC Bypass using CMSTP 2->69 71 Yara detected RedLine Stealer 2->71 73 6 other signatures 2->73 8 VuMhXFFSwX.exe 23 10 2->8         started        13 svchost.exe 2->13         started        15 svchost.exe 2->15         started        signatures3 process4 dnsIp5 55 cdn.discordapp.com 162.159.135.233, 443, 49745, 49750 CLOUDFLARENETUS United States 8->55 57 192.168.2.1 unknown unknown 8->57 39 C:\Windows\Cursors\Turneries\svchost.exe, PE32 8->39 dropped 41 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->41 dropped 43 C:\Users\user\AppData\...\VuMhXFFSwX.exe.log, ASCII 8->43 dropped 45 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 8->45 dropped 75 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->75 77 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->77 79 Creates an autostart registry key pointing to binary in C:\Windows 8->79 81 Drops PE files with benign system names 8->81 17 VuMhXFFSwX.exe 8->17         started        21 powershell.exe 24 8->21         started        23 powershell.exe 25 8->23         started        27 3 other processes 8->27 59 162.159.129.233, 443, 49757, 49758 CLOUDFLARENETUS United States 13->59 47 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 13->47 dropped 83 System process connects to network (likely due to code injection or exploit) 13->83 85 Multi AV Scanner detection for dropped file 13->85 87 Machine Learning detection for dropped file 13->87 89 Injects a PE file into a foreign processes 13->89 25 powershell.exe 13->25         started        61 162.159.130.233, 443, 49759, 49760 CLOUDFLARENETUS United States 15->61 49 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 15->49 dropped 91 Drops executables to the windows directory (C:\Windows) and starts them 15->91 93 Adds a directory exclusion to Windows Defender 15->93 95 Sample uses process hollowing technique 15->95 file6 signatures7 process8 dnsIp9 51 23.94.183.146, 49763, 49776, 49777 AS-COLOCROSSINGUS United States 17->51 63 Tries to harvest and steal browser information (history, passwords, etc) 17->63 65 Tries to steal Crypto Currency Wallets 17->65 29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        33 conhost.exe 27->33         started        35 AdvancedRun.exe 27->35         started        37 conhost.exe 27->37         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-10-31 04:38:54 UTC
AV detection:
14 of 44 (31.82%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
035ffcab1903dbf2f58155dfb50c14f2463e01fe9cf46baa4cf678f7e6b255ff
RedLineStealer
1f4ccad233d733ecf2c0374593f95ea0bd521a17e82206b17fd74948faca974c
RedLineStealer
5d5a4e577c7e58c88e50a4c6553943a861ed52728255a3f549ab02d673853a70
RedLineStealer
60c65307f80b12d2a8d8820756e900214ad19a1fcfcda18cdbee3a25974235ac
RedLineStealer
9e8bbc3cd87e16335a700fee228e9fa3ed6f67209b0297f5997c50097b7f8386
RedLineStealer
b33514e7b334b8aee694323114c7d2694f3cdb49c7614291ca8f064c23ff8542
RedLineStealer
b434b3190e481f0f0fe310e16b560ddd47aa76bcda84e4fdb81499047cc54e06
RedLineStealer
cebf4c9af84506f3b683d5d4867b739244b6ba595772d583b3455781c4d91b74
RedLineStealer
e5e0601b8269cf5ffd12af1b005d913fd5d70235841daf3017a9cbb5da483dce
RedLineStealer
+ 1'249 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/211031-jj9aeafga3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
Nirsoft
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine Payload
Turns off Windows Defender SpyNet reporting
Windows security bypass
Unpacked files
SH256 hash:
fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf
MD5 hash:
a0b683676361fd47b3a285abf785d0b8
SHA1 hash:
f9fd3568f5a131b44df80212aa6080251a36c6b9
Link:
https://www.unpac.me/results/4ae84f9c-4425-4cb8-a79d-9ebac6880988/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe fb22d463b5a19f625c6c966b860e6cf91d79d23077b137c01d698bfc9f9eecbf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1729489/
  
Delivery method
Distributed via web download

Comments