MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71
SHA3-384 hash: 213b26c780f939b8b118aa3cf06b1c3c701a3d048d03b06f1871f350c554b190c6fac8317b9786cb6b64d765dab58f84
SHA1 hash: f30e50655abeb2509fa313fdef291afddc9d8218
MD5 hash: d3d2aafaf86262baa7528e397f1ce761
humanhash: aspen-november-montana-hot
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:404'992 bytes
First seen:2024-09-16 10:40:09 UTC
Last seen:2024-09-16 11:11:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bf5a4aa99e5b160f8521cadd6bfe73b8 (432 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep 12288:Zh1Lk70Tnvjcd5zpOEa26FvemK2h/JGIBDdY5L:Fk70Trcd5/a2IeRs/J5TY5L
TLSH T15484CF163550D1BAC865C8B2C58EC6F18A277CBDC7B455C3B6C87F2B7E706B1A2252C8
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon f9b17165351d1d8d (2 x RedLineStealer, 1 x Vidar, 1 x PrivateLoader)
Reporter Bitsight
Tags:exe RedLineStealer


Avatar
Bitsight
url: http://147.45.44.104/revada/66e805302f63c_otr.exe#kisotrmeta

Intelligence

File Origin
# of uploads :
2
# of downloads :
470
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e80b402ebf76853bd5d4c8
Tags:
Infostealer Static Stealth
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint microsoft_visual_cc packed redline
Link:
https://www.filescan.io/uploads/66e80b400883d6a903eb7b16/reports/378d15a2-169d-44db-b4a1-cca2b0e16ce7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d7cc0f07-c16e-4cfc-812f-981b5396aad2
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1511800
Signature
.NET source code contains very large array initializations
AI detected suspicious sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Reads the System eventlog
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71/
Threat name:
ByteCode-MSIL.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2024-09-16 10:41:04 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g27pyxyzv4rlhnzryvz3qjcnpzyklfdta6etkgzuodopzl42pzyq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline credential_access discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240916-mq39hsshnh/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Credentials from Password Stores: Credentials from Web Browsers
RedLine
RedLine payload
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ca5c1e7e-a8ba-4a39-8a0a-4d6067a26dbf
Unpacked files
SH256 hash:
f5e07d2e0c9ceb5df71b3ee3f110fdb8b03126eae750a5333aeff33d86723cd8
MD5 hash:
a9f534a794019400ed13072154ce1589
SHA1 hash:
9510eba258b3ddbcda6ee5d8b833218c9ef0fb58
Detections:
MALWARE_Win_MetaStealer
Create hunting rule
Link:
https://www.unpac.me/results/c794dc02-37ec-4228-aef9-3e6ac6fd6925/
SH256 hash:
08d81cc497016ad26d6a85327ad323f65fee42dfa654180da43c41182d8e2fc9
MD5 hash:
2d26801aa3bf01dbcdef174253646e59
SHA1 hash:
771bc2a9708d523c039828d40c984cfb822d4e3b
Detections:
MALWARE_Win_MetaStealer
Create hunting rule
RedLine_Campaign_June2021
Create hunting rule
Link:
https://www.unpac.me/results/c794dc02-37ec-4228-aef9-3e6ac6fd6925/
SH256 hash:
36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71
MD5 hash:
d3d2aafaf86262baa7528e397f1ce761
SHA1 hash:
f30e50655abeb2509fa313fdef291afddc9d8218
Detections:
win_samsam_auto
Create hunting rule
MAL_Malware_Imphash_Mar23_1
Create hunting rule
SUSP_OBF_NET_Reactor_Native_Stub_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c794dc02-37ec-4228-aef9-3e6ac6fd6925/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/36befc5f19af/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 36befc5f19af22b3b731c573b8244d7e70a594730789351b3470dcfcaf9a7e71

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3176711/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA

Comments