MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 18

Intelligence 18 IOCs YARA 4 File information Comments

SHA256 hash:	04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445
SHA3-384 hash:	7df16f3184e922dc8d8fde635112246e3d5849c381d0882151d9c71851d203a3869fe33f278314d3de301489e44c9683
SHA1 hash:	f27427a9f0ba8e46d49eff6706979198be06805f
MD5 hash:	81e5e17e9890e982944146d1cdf83853
humanhash:	sink-india-fruit-west
File name:	file
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	550'400 bytes
First seen:	2024-07-07 18:35:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	55c0acf36986dbee7526009f420c04cb (2 x RedLineStealer, 1 x DCRat, 1 x Stealc)
ssdeep	12288:TZF2IZlyMyaDM1QDup4UR4tvR7m1Qf67T1u3duA+xQftx:TZFrlyMLrDs4BR7m1P1xw
TLSH	T106C4F11176C0C072CBB311730AA4D7B56E7EBC710AA15A9FA7941AAFCF30191EF3165A
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	Bitsight
Tags:	exe RedLineStealer

Bitsight

url: https://vk.com/doc851967711_679152886?hash=HRLDfDcZVZ3wvKnE7PbhWPRWPg52y3K96fHbBSOsGZw&dl=I2zz4vFqaBzRqrFZ0MRlEE65WQhupJn8mZecSYTTC5H&api=1&no_preview=1#1

Intelligence

File Origin

# of uploads :

# of downloads :

395

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445.exe

Verdict:

Malicious activity

Analysis date:

2024-07-07 18:37:15 UTC

Tags:

stealer redline metastealer

Link:

https://app.any.run/tasks/9883744b-b713-4a56-b6b0-256bf56743bc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Keylogger.Lazy-10031941-0

Win.Packed.Zusy-10032583-0

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=668ae01327fa347bfaae7efewin7simulatehigh_evasion

Tags:

Redlinesteal

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file

Launching a process

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Сreating synchronization primitives

Connection attempt to an infection source

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Forced shutdown of a browser

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

epmicrosoft_visual_cc fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/668ae013fa6ffdddde46a74f/reports/5a866e1b-9b5e-4b68-8784-e4264f6814dd/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/87b8392d-4275-4a89-bae4-9ab12478df0c

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1468751

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2024-07-07 18:36:12 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aqbiqcnvaxyaamnw6ajvzjpocagssgalkmkrwo22nlfkjzhj4rcq._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:logsdiller cloud (tg: @logsdillabot) discovery infostealer spyware stealer

Link:

https://tria.ge/reports/240707-w8w3layekg/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

77.105.135.107:3445

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0ff96d0b-6cc0-4ad0-811e-9b017bd2e9ad

Unpacked files

SH256 hash:

f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9

MD5 hash:

65f8fcab7cfe7aecbdd653d2ec0837ed

SHA1 hash:

ea9596a2624d5790c2bc4df8a68cfa0f058e6b29

Detections:

redline

Link:

https://www.unpac.me/results/603017ee-0292-4b8f-8818-378559cafe28/

Parent samples :

ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137
cf47a943ec0eb86c16a8d7e6e0ad8c4bfb6063af089e1b3809ed44ac45347e71
c4024302b2f74461f6aecd5ca2f2889fa8ed48a420cb2176ae782368e2c5c6eb
fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b
7cf88e667498e50034c25767aaf38bca971a5c995f61fe686b44f7bcc0f71851
11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8
b6bc0277793660688621a374f2c09c7cd3801ab09e849568627295618a33ebde
04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445
15d42ae4cb79d31477b5b65884a5fe2cd73a6dc05ff384c00c6d8dc0d93af189
888452aed556bafda19c8899eedb37b71533f7ad316f03c2c4d5f5b1956d45f4
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9
96b5ad76adbcdbd8794fc6ba8209ffdda1815304eda98e5b6d12d2aee2ff0051
73f00d2746a71e412b9c6d43c7f5e0ed5faf3e03730bfd6e24b8955e42c2267e
7010eb737bc8cbc8598ae5de392f485406f7fd1e821f0d7e6649f3022fcf8ac8
f408c8ba5781966f6ce1da805de79deb4a5e3c9dfbe097493123257e6112bf71
b190b4f3105af4a2a02db28f27d1c723c09ba419ef73a89b555078c5041a2486
96db11589e31f55a3bb06de8f13246d3220a483e5ff41f8fabbb1070e0bf52fa
93058e43cdbdae3b4cd091a75e0e5c11e944dd7e2ca76f3ad09c7470e8162503
86cc1b1b3f36ddee258f2bae60a7a77a0dded47b080f7911eb5b7013912f7ace

SH256 hash:

04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445

MD5 hash:

81e5e17e9890e982944146d1cdf83853

SHA1 hash:

f27427a9f0ba8e46d49eff6706979198be06805f

Link:

https://www.unpac.me/results/603017ee-0292-4b8f-8818-378559cafe28/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/04028809b505/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445

(this sample)

Dropped by

Privateloader

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread KERNEL32.dll::CreateThreadpoolWork
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample