MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43a11dc51466ad997be306e92196fbe2d4d6e4336e7e831df57998b512129eab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43a11dc51466ad997be306e92196fbe2d4d6e4336e7e831df57998b512129eab
SHA3-384 hash: 41081d9439c9c0a2773867700ddd7db96f27dff5bc05d2a183fd559999d82e50f650bc3173fa8ea47efd6bf6ab724ef9
SHA1 hash: 0efb0fb5ebbfc2fd828174987703bb5e070b24fe
MD5 hash: ec10291029375563c6f4f5151700e789
humanhash: london-tango-hawaii-mountain
File name:ec10291029375563c6f4f5151700e789
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:3'820'472 bytes
First seen:2021-08-18 20:17:18 UTC
Last seen:2021-08-18 20:56:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 98304:GawXP1a8KZ7Keo+CMgxUEYkwbqVF7HclD:GawXP1aVZWj+CMgxUEjwbqV1Hc1
Threatray 1'207 similar samples on MalwareBazaar
TLSH T16D06236CAFFF9479F9F25730D6A2C9410DAE3C7D2BE280182D78E90D04B5586B872752
dhash icon 6460f0904d4ca94d (2 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer signed

Code Signing Certificate

Organisation:Corel Corporation
Issuer:DigiCert SHA2 Assured ID Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2020-10-20T00:00:00Z
Valid to:2022-10-24T23:59:59Z
Serial number: 099480698f2880aa5e6cbace72f02677
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 06094af0ed0d9de7ac9571fcae4bee97c3aafbe853b93ea06661a5c11857f3c4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ec10291029375563c6f4f5151700e789
Verdict:
Suspicious activity
Analysis date:
2021-08-18 20:17:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2163da68-63a6-4b6b-a73f-97de6d64813a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180446/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.1785.23544.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
DNS request
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2399b10a-f4f9-4aff-a5e4-85807c05e431
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/835366
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Potential time zone aware malware
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses known network protocols on non-standard ports
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43a11dc51466ad997be306e92196fbe2d4d6e4336e7e831df57998b512129eab/
Threat name:
ByteCode-MSIL.Infostealer.Reline
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 20:18:05 UTC
File Type:
PE (Exe)
Extracted files:
30
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1e39513b16501c1ff55a8a9d4c7b4b27ad067f3063002541b74b43e547ca8bf8
RedLineStealer
3cb8753735a439dad2d7ab713cde180e9f253c6099ad7a628e1b16564693da0a
RedLineStealer
5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129
RedLineStealer
61cafe16ef316179718e8827d2c0d37604639050956b95d1167ce4b1ac601948
RedLineStealer
6bf5f4826e8a08a51efd8c251af36a1730d57487a0e598dbd74b6fbe8a11d7ed
RedLineStealer
881809c7838ffda4805b1968e37c25dd5f1d9d02a6a2aadb7695705167d45cd2
RedLineStealer
966587a4421c9d7cab7b5defc79a47e7c319f0bd4166678d3a0425b85ca540bb
RedLineStealer
+ 1'197 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline evasion infostealer themida trojan
Link:
https://tria.ge/reports/210818-cszmsnnpce/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
RedLine
Unpacked files
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/e478213e-e40e-4ac0-8ad1-e3f8aa043a14/
SH256 hash:
43a11dc51466ad997be306e92196fbe2d4d6e4336e7e831df57998b512129eab
MD5 hash:
ec10291029375563c6f4f5151700e789
SHA1 hash:
0efb0fb5ebbfc2fd828174987703bb5e070b24fe
Link:
https://www.unpac.me/results/e478213e-e40e-4ac0-8ad1-e3f8aa043a14/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.04
Link:
https://yomi.yoroi.company/submissions/43a11dc51466ad997be306e92196fbe2d4d6e4336e7e831df57998b512129eab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 43a11dc51466ad997be306e92196fbe2d4d6e4336e7e831df57998b512129eab

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1544720/
Cape
Cape
https://www.capesandbox.com/analysis/180446/
  
URLhaus
https://urlhaus.abuse.ch/url/1545768/

Comments


Avatar
zbet commented on 2021-08-18 20:17:19 UTC

url : hxxp://193.142.59.119/forum/images/kl4.exe