MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365
SHA3-384 hash: 63df8190c1ec69ae9741b77d4d7545af78dc5345378efecb1d027713312e7d9d906853492586e93b1bd9c198c22a3930
SHA1 hash: 64cc18e1eaab5d92ff4731a9443b69e1e9ac44cc
MD5 hash: 258798b252e692430052f5e5be7adda0
humanhash: alaska-massachusetts-carbon-virginia
File name:258798b252e692430052f5e5be7adda0
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:74'240 bytes
First seen:2021-10-31 22:15:50 UTC
Last seen:2021-11-01 00:15:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:MOPAY2EZEro0NoY2JTeXePKL3N9ggf3JOLd:MOPA7BNb2iD/ggf3JOLd
Threatray 1'681 similar samples on MalwareBazaar
TLSH T1B273C7B7416194A6C1892730F4B51F0B3A7CC6381980B698F04FF2AEDC1D69D9EF87A5
File icon (PE):PE icon
dhash icon e82acdc9b9c6f2c2 (4 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
258798b252e692430052f5e5be7adda0
Verdict:
Malicious activity
Analysis date:
2021-10-31 22:25:53 UTC
Tags:
trojan rat redline stealer evasion
Link:
https://app.any.run/tasks/2f87a6a3-cb68-48f7-a656-cb7b25cfd64f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.22290.5366.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/60ffc4d7-2fbd-4e85-aa23-2494c5f7d92e
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/880075
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Regsvr32 Anomaly
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Submitted sample is a known malware sample
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 512505 Sample: jALHWNY88R Startdate: 31/10/2021 Architecture: WINDOWS Score: 100 97 Multi AV Scanner detection for submitted file 2->97 99 Yara detected RedLine Stealer 2->99 101 .NET source code contains method to dynamically call methods (often used by packers) 2->101 103 12 other signatures 2->103 12 jALHWNY88R.exe 15 10 2->12         started        process3 dnsIp4 87 iplogger.org 88.99.66.31, 443, 49754, 49755 HETZNER-ASDE Germany 12->87 89 my-all-group.bar 172.67.169.45, 443, 49743, 49744 CLOUDFLARENETUS United States 12->89 91 whealclothing.xyz 12->91 63 C:\ProgramData\8585796.exe, PE32 12->63 dropped 65 C:\ProgramData\6701223.exe, PE32 12->65 dropped 67 C:\ProgramData\3384323.exe, PE32 12->67 dropped 69 4 other malicious files 12->69 dropped 129 Detected unpacking (changes PE section rights) 12->129 131 May check the online IP address of the machine 12->131 133 Performs DNS queries to domains with low reputation 12->133 17 8585796.exe 14 3 12->17         started        21 6701223.exe 5 12->21         started        24 3384323.exe 12->24         started        26 3 other processes 12->26 file5 signatures6 process7 dnsIp8 75 querahinor.xyz 45.129.99.59, 49761, 80 GMHOSTUA Estonia 17->75 77 api.ip.sb 17->77 105 Multi AV Scanner detection for dropped file 17->105 107 Detected unpacking (changes PE section rights) 17->107 109 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->109 125 2 other signatures 17->125 79 185.215.113.87, 49748, 51436 WHOLESALECONNECTIONSNL Portugal 21->79 61 C:\Users\user\AppData\...\6701223.exe.log, ASCII 21->61 dropped 111 Query firmware table information (likely to detect VMs) 21->111 113 Machine Learning detection for dropped file 21->113 115 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->115 81 193.150.103.37, 29118, 49803 ASGENERALTELRU Russian Federation 24->81 117 Tries to detect sandboxes and other dynamic analysis tools (window names) 24->117 119 Tries to steal Crypto Currency Wallets 24->119 121 Hides threads from debuggers 24->121 83 jordanserver232.com 104.21.60.71, 443, 49758 CLOUDFLARENETUS United States 26->83 85 glitterandsparkle.net 172.67.201.11, 443, 49746 CLOUDFLARENETUS United States 26->85 123 Tries to harvest and steal browser information (history, passwords, etc) 26->123 28 mshta.exe 26->28         started        file9 signatures10 process11 dnsIp12 93 192.168.2.1 unknown unknown 28->93 31 cmd.exe 28->31         started        process13 file14 73 C:\Users\user\AppData\Local\Temp\ozR8x.ExE, PE32 31->73 dropped 95 Submitted sample is a known malware sample 31->95 35 ozR8x.ExE 31->35         started        38 conhost.exe 31->38         started        40 taskkill.exe 31->40         started        signatures15 process16 signatures17 127 Machine Learning detection for dropped file 35->127 42 mshta.exe 35->42         started        44 mshta.exe 35->44         started        process18 process19 46 cmd.exe 42->46         started        49 cmd.exe 44->49         started        file20 71 C:\Users\user\AppData\Local\Temp\WaVZQ~GT.C, PE32 46->71 dropped 51 conhost.exe 46->51         started        53 cmd.exe 46->53         started        55 cmd.exe 46->55         started        57 regsvr32.exe 46->57         started        59 conhost.exe 49->59         started        process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-10-31 22:16:06 UTC
AV detection:
12 of 27 (44.44%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0091825486c2d7cfdee49e98c6795be8d32a7f50a68e0d33542b1f047fb7ed7a
RedLineStealer
17ae329b1ffd8bd8f503fe74eb8bf59982b5fa3d58d7b67545e2a64d316a4c68
RedLineStealer
3aa947c9f9eafb67064ea9cf2f0d1ec335a301a81e89f24faefefec3f6a0a2a3
RedLineStealer
61cafe16ef316179718e8827d2c0d37604639050956b95d1167ce4b1ac601948
RedLineStealer
89e3b00acfc8b0904398665280312cf9a2b426db3eb77b2e5303131de48a2dde
RedLineStealer
d620056c5defae218de13235fc4a509d968bd55469092aa00095ff94a0246b7f
RedLineStealer
e5c7a8e3c41afa656fe8a0db72a99f86f93aa4085dd1860aa1dd67099ac228aa
RedLineStealer
f4f37faf7b52b7544ee58a029dcc54a71941aedcdd2b4eacda2f39c3217aad48
RedLineStealer
fc40949e683c9024184a97d697f9f18494aaff1d0d524a070c47661a786e4e7e
RedLineStealer
+ 1'671 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/211031-16splsgeb9/
Behaviour
Kills process with taskkill
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
8c946f1b591ac25a581e0e419495ab057ea2c0ad08e7d7310dc222ef9ff4a4b0
MD5 hash:
178a4ba7387043ffbc4341a133bfb3b4
SHA1 hash:
706d2fb4b0b7089b0a5f4cedfaf9394d8f04bfe6
Link:
https://www.unpac.me/results/eee484d7-56cb-4b9f-b781-baa7935f1e15/
SH256 hash:
2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365
MD5 hash:
258798b252e692430052f5e5be7adda0
SHA1 hash:
64cc18e1eaab5d92ff4731a9443b69e1e9ac44cc
Link:
https://www.unpac.me/results/eee484d7-56cb-4b9f-b781-baa7935f1e15/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2d1e2d6b4008/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 2d1e2d6b40087947ca8ef5c550b6eafee045fda4bc746a413cdbaf65f9b2f365

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1734055/

Comments


Avatar
zbet commented on 2021-10-31 22:15:51 UTC

url : hxxps://mladtehnik.com/image/flags/Softw75TradingB26345.exe