MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
SHA3-384 hash: 26f0a8501cbad06920a31a6ef4755995983291ce03e9a450c8d5e98dda24fbc6266b149f47f166fdbe532a3500378784
SHA1 hash: 7900e5214fcb1c6be206e72f96c25cf6dd2f11ab
MD5 hash: 86eb1197449d5c977d37805f347d20fb
humanhash: north-north-edward-iowa
File name:SecuriteInfo.com.Win32.PWSX-gen.11209.1921
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:479'232 bytes
First seen:2024-02-17 04:28:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 140f68ca5d8c01b19a34d785fa5fc14d (1 x RedLineStealer)
ssdeep 12288:YVef96Y9OD2l5+Jjhu/jgdO2ZFbqw9rBx2njPvUfHA6S:YVZY9tEvJZFGw9rBUzcfe
TLSH T13AA40124AFE5C031D39351B5CA25CBB18FBF783161A2E89F5BC347B92F247918618369
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon d2f0e4c0ccf9c6f9 (1 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
MetaStealer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/476569/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.11209.1921.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint masquerade packed
Link:
https://www.filescan.io/uploads/65d0360fe304215defb2d48f/reports/0634dca3-148d-4b35-a12d-4c41525a577c/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/215f787a-fbd7-4ff1-918f-d12576f5ced5
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1393814
Signature
.NET source code contains very large array initializations
Contains functionality to inject code into remote processes
Detected unpacking (overwrites its own PE header)
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1393814 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 17/02/2024 Architecture: WINDOWS Score: 100 26 Snort IDS alert for network traffic 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for dropped file 2->30 32 4 other signatures 2->32 7 SecuriteInfo.com.Win32.PWSX-gen.11209.1921.exe 2->7         started        10 qemu-ga.exe 2->10         started        process3 signatures4 34 Detected unpacking (overwrites its own PE header) 7->34 36 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->36 38 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 7->38 42 3 other signatures 7->42 12 SecuriteInfo.com.Win32.PWSX-gen.11209.1921.exe 6 7->12         started        40 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->40 process5 dnsIp6 22 85.209.11.85, 41140, 49734 SYNGB Russian Federation 12->22 20 C:\Users\user\AppData\Roaming\...\qemu-ga.exe, PE32 12->20 dropped 44 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 12->44 46 Tries to harvest and steal browser information (history, passwords, etc) 12->46 17 qemu-ga.exe 12->17         started        file7 signatures8 process9 signatures10 24 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 17->24
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d/
Threat name:
Win32.Trojan.Recordbreaker
Create hunting rule
Status:
Malicious
First seen:
2024-02-17 04:29:05 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7tqrc3cxnzu7phuinb23mxthiukzo35geidyznqf7e26p6uje6q._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240217-e38qrsah3x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
RedLine
RedLine payload
Unpacked files
SH256 hash:
b93b81e47fa5569de1f85ae01b52eb1963983e8f2fb9dc8e0511bf7357ad73f5
MD5 hash:
72798196a76873fbd69b0868e0bf8150
SHA1 hash:
d77ae50f56543c23eaa73c0790d0d3e332f0925e
Link:
https://www.unpac.me/results/326da950-5977-4d7c-965e-44b044dc63fd/
SH256 hash:
75f6a7c7bd89503e8d124ea03e84189de8e5c40db7627ce107c6a9dd5f3dadfe
MD5 hash:
42ae66204215563c60023c4a6f73c9a4
SHA1 hash:
4208a13397755bc97b66ddbfbbfb8901ccf067a4
Detections:
RedLine_Campaign_June2021
Create hunting rule
Link:
https://www.unpac.me/results/326da950-5977-4d7c-965e-44b044dc63fd/
Parent samples :
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SH256 hash:
d0bc689366b419dc035bc7fff934d2c4e8b73f19e06d38aabf44c9e39d723510
MD5 hash:
baf26a9a9e834c91797471467abd7fcb
SHA1 hash:
82221b441d2e61f3536b2d3c8f14dd49695844d5
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/326da950-5977-4d7c-965e-44b044dc63fd/
Parent samples :
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SH256 hash:
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
MD5 hash:
86eb1197449d5c977d37805f347d20fb
SHA1 hash:
7900e5214fcb1c6be206e72f96c25cf6dd2f11ab
Link:
https://www.unpac.me/results/326da950-5977-4d7c-965e-44b044dc63fd/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1fe7088b62bb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2762638/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/476569/

Comments