MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30e7e8b04fbdd2e6a0abb502d6308c67fc0c42549f05e89198bd2ac0c719334b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 2

Intelligence 2 IOCs 1 YARA 7 File information Comments

SHA256 hash:	30e7e8b04fbdd2e6a0abb502d6308c67fc0c42549f05e89198bd2ac0c719334b
SHA3-384 hash:	953b4be4076b0daca4b88ae819e84993d860de35f354a23c16d9b205d35c36e0d04b6872f0d7b6d09f069dc17bd6ac14
SHA1 hash:	9f31aa3d9c806e31284d4912073063e78bde00ef
MD5 hash:	e9689545610327d8fdd86d3277461de8
humanhash:	floor-pluto-angel-jersey
File name:	pureland.7z
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	346'050 bytes
First seen:	2023-03-03 08:40:02 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: pureland
ssdeep	6144:tf5/4BhQYZr3+FIc+n1iB/WWl5jSK/SFGpPR8kyx3KC/ZhWRK8Fu:tf+r3+FIc+4B+Wl5p/3+jrP
TLSH	T1F37423CF18BEB95A79B831D0334BEC89D4D161DBD6186F5768064F8F931AD2428AF234
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Reporter	iamdeadlyz
Tags:	162-55-188-117 7z exe file-pumped PureLand pw pureland RedLineStealer

Iamdeadlyz

From thepureland.io (impersonation of Rune Teller - https://store.steampowered.com/app/1944360/Rune_Teller/)
https://iamdeadlyz.gitbook.io/malware-research/march-2023/pureland-a-fake-project-related-to-the-sandbox-malspam
RedLineStealer C&C: 162.55.188.117:48958

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
162.55.188.117:48958	https://threatfox.abuse.ch/ioc/1078699/

Intelligence

File Origin

# of uploads :

# of downloads :

245

Origin country :

n/a

File Archive Information

This file is a password protected archive. The password is: pureland

This file archive contains 1 file(s), sorted by their relevance:

File name:	pureland.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	688'145'872 bytes
SHA256 hash:	de57a7a49d78ccab0c875e193e5e4949a87e394bda3bb1fe950c724ef78f6f73
MD5 hash:	2a8c603669379c077a19b02017e176e2
De-pumped file size:	271'360 bytes (Vs. original size of 688'145'872 bytes)
De-pumped SHA256 hash:	b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05
De-pumped MD5 hash:	a1a2935b1e618d810a60a222d649e3c6
MIME type:	application/x-dosexec
Signature	RedLineStealer

Vendor Threat Intelligence

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/30e7e8b04fbdd2e6a0abb502d6308c67fc0c42549f05e89198bd2ac0c719334b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/30e7e8b04fbdd2e6a0abb502d6308c67fc0c42549f05e89198bd2ac0c719334b/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gdt6rmcpxxjoniflwubnmmemm76ayqsut4c6remyxuvmbryzgnfq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/230303-kxrg7agc5y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Uses the VBS compiler for execution

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	Saudi_Phish_Trojan Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a trojan used in Saudi Aramco Phishing
Reference:	https://goo.gl/Z3JUAA

Rule name:	Saudi_Phish_Trojan_RID2E2F Create hunting rule
Author:	Florian Roth
Description:	Detects a trojan used in Saudi Aramco Phishing
Reference:	https://goo.gl/Z3JUAA