MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 18


Intelligence 18 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777
SHA3-384 hash: e5d9164fe42e741fd4e5d7c0e561c03b3240e3a071d7fdf9002e9ac06b88baa046b5aeebbbfcb8bb60d2f9555f3ebd74
SHA1 hash: 8848902330063c7365485c017eab6eea614868e0
MD5 hash: 40199eda5bfaf9464bf66ef0adee84d0
humanhash: four-aspen-stairway-princess
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'710'592 bytes
First seen:2023-08-23 22:36:10 UTC
Last seen:2023-08-24 17:55:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 234f249f148b6c56eb212de604bfda4d (2 x RedLineStealer)
ssdeep 24576:VjxxR2FSNToj5oQfOyWa33wKG6GtxPE9A6M:VaSNToj5osOprHE9A6M
Threatray 1'802 similar samples on MalwareBazaar
TLSH T188856C11BC817132EEE317FA47FDB42482EDA3A0371516DB5588A2FF8A616D33B3154A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:exe RedLineStealer


Avatar
andretavare5
Sample downloaded from https://vk.com/doc44017378_668305087?hash=TuocKpTKJDaGHrC0HTDbLSAP7ILM8xAQgYNUm78Bmgc&dl=pQmbc6zVZsxint9VqlO9DcFBndvLOtSqeXbOXCsW4yo&api=1&no_preview=1#start

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-08-23 22:38:34 UTC
Tags:
stealer redline
Link:
https://app.any.run/tasks/464b6363-8a47-460c-b9dd-69315469f9cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/444361/
Detection(s):
SecuriteInfo.com.Trojan.PWS.RedLineNET.7.28254.5935.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/108404/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/64e68a102a89064e5598b718/reports/0f64633e-6e6b-4920-a95e-c74b258b07ac/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32c8c95d-8ed5-4038-8ef6-551141b5c9a1
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1296232
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-08-23 22:37:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
16 of 38 (42.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eq47os6j4jkjfk5hw5hjo52vjrma7xgi5mvb2tf6d7mdw6bzy53q._file
Verdict:
malicious
Similar samples:
3d9ff047118451feee7311190c00d05d95209c6b1e707ce18abe065017b845b8
RedLineStealer
622f16562811a002395e2139567050430b62bd09ca5cd5967a129f6594e76875
RedLineStealer
6dd1a8408e598604e40099415b555bb490cef19c9c096944f693bc0bea46a099
RedLineStealer
73a232f3b97846b0cda9708eb7781ca10f00c32c7137b97e84be70ce9f3c750a
RedLineStealer
7b40c4128a50bad16a3eaff13a76098cdb3f97cd9e5375df3473c173adbf37da
RedLineStealer
aa46c78978d744edae1170acdc7a518ff42bb02eba66a52724d46226b15c4633
RedLineStealer
e6dc45b261c3eb6b27fc2258f74d69bad8cf31059f051636f36d7352bf6b0c98
RedLineStealer
f3d9b0ff14159268907bd176413b3ffac1fd245debb622be0d24e019444aa36c
RedLineStealer
f432f9cb89ee9ea1704bf3d33c85f19483a4258f4277b126201930dff9d119f5
RedLineStealer
feb7a9aaa07a32e7d6431a818eda93f485ed2c382a65d38a15416598d1791260
RedLineStealer
+ 1'792 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:1006 infostealer spyware
Link:
https://tria.ge/reports/230823-2jslrsgb46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Uses the VBS compiler for execution
RedLine
Malware Config
C2 Extraction:
176.123.9.142:14845
Unpacked files
SH256 hash:
67a04ff65a6c75f92b89263ea96efae791644cbaecb40ea5405501c3f4afda32
MD5 hash:
bbffbd34e64f21e6c0978a1e106c1529
SHA1 hash:
b3c49e2c495bd8bf528adfdce30bc90c93fe01fb
Link:
https://www.unpac.me/results/74eab80a-d383-4078-b919-7817b65b0d33/
SH256 hash:
e200f37667683548d2f888f21759ed79c2a758e3322dbdc579aac45887ae9982
MD5 hash:
7390ec23d942b522a4c25145ab8df55a
SHA1 hash:
0a85b1f1f919d291187c7f297306c1bddcc3a86e
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/74eab80a-d383-4078-b919-7817b65b0d33/
Parent samples :
2e2d33e8525c89a48e87802cc4b75e99ce40797826cd8b03bff1dbcbbb344072
27e5e5b03cc0d6a14205c26d63eb7ae0f522f2829f7e94f5524e304147fc1445
ef18e6f222c2c09b7fe21e19ddf9533510deae77e51e63d3c24a9f46e8701c82
2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777
d7090bd33b04f71ac9f01ac7ad9581ea1066a52844b74417d4027ca27475ce72
99550f4b46a2b9b5f6b1e72116e84973ab22cbb2b1f8d2a03dc919db4cb93952
4cd2c0f587430ac6add333d7edf854160e0a4d903edcb7386d6f87d2cbb4b9b5
f028eb7c28f4ad3126755a211a47f206812b182adb4ddb45c225802af1a27eab
2c7e13c2666ebf9ef03bc0d8905e4876d3f3366a6f4ec326880b9db33f197e04
e79fff220e5b914ac939c7db318754c1eef76a534370cf8903f7c4d6960afe58
e9086d430ff782f142e2660ae72526eb2a0468ec0ab01f712f75a07577412017
e6e84acfab6cd72f2d1a8e6847a42324e19669f83a69f51c2d4834eba3b9ee25
a52b1bac7fc89df6491f6528ef4ed0f23b35d7e55b5c133ae6488f3efa80fba5
60447c2bd00cc88d5e91284586fa91357ad5f4b1539949b84b1c204afd456865
3d787306f412bf5a77ec3061ce5acad0606f094734188545c0c493cc3420e3b8
46c2a7ae303529e1b3f695d883c0b0fb0ab0b0cc8bf97a5cf7ae94a4ff20e80c
648aa939a0bb4177d337fe526bbf2b7c70a797fe359c75c7c7658839604a4999
98ef4e193a3bfbad975da685ebb6d334c214f4fa0f5a2e5420bd9ba6dd2c3f60
2885c075025d864d3b77b91bd576e9d5fe83070ad742f31c27acc07bd3fb9955
dbf79d65990a6cf775a6be1bf5d328ec25783fa5f1a518a0e0c85d455104556a
SH256 hash:
2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777
MD5 hash:
40199eda5bfaf9464bf66ef0adee84d0
SHA1 hash:
8848902330063c7365485c017eab6eea614868e0
Link:
https://www.unpac.me/results/74eab80a-d383-4078-b919-7817b65b0d33/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2439f74bc9e2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2439f74bc9e25492aba7b74e9777554c580fdcc8eb2a1d4cbe1fd83b7839c777

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/444361/

Comments