MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
SHA3-384 hash: 9991e45884e6e9830de741feae9d18a2619cb66a7c6f44720c4ad0dae9ddb19b7890717c84769c054f305ba3e9333094
SHA1 hash: 384c2fab9badfa36e3af1df8827e51de06c5615d
MD5 hash: 82cdc3929a00fcb38376e0ab0e6e71c2
humanhash: fix-neptune-alanine-neptune
File name:SecuriteInfo.com.Win32.TrojanX-gen.10958.28541
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:475'648 bytes
First seen:2024-02-17 03:28:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ab4b20db27905f9ef383a4e0564b2b9d (3 x RedLineStealer)
ssdeep 12288:YthvZeaBzUU+Ibh+YWfGFAYozZaPQP0Xpf:YthlU8V+YWfGF9ozMPu4f
Threatray 9 similar samples on MalwareBazaar
TLSH T140A4F11022E5C073D38319B4856DCBB14ABA78726175998F6BD78A3A2F347B1C61D33E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 3370ccd2ccf033da (36 x Smoke Loader, 10 x Stealc, 8 x GCleaner)
Reporter SecuriteInfoCom
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
320
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
MetaStealer
Create hunting rule
Link:
https://www.capesandbox.com/analysis/476563/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.10958.28541.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint packed
Link:
https://www.filescan.io/uploads/65d0280003a1c3a7aeef34a7/reports/e1a9f6e5-4547-47ba-a603-d46e2c075022/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4dd3e9f1-8a8e-4241-a728-2f6efdc501ed
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1393805
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops PE files to the startup folder
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-02-17 03:29:06 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
14 of 23 (60.87%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=it5dxge3a4g4iohp2vdakeh3gkmya3kji52q2abxciatfqas5g2q._file
Verdict:
malicious
Similar samples:
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
RedLineStealer
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
RedLineStealer
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
RedLineStealer
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
RedLineStealer
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
RedLineStealer
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240217-d1w4hsah56/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
RedLine
RedLine payload
Unpacked files
SH256 hash:
b93b81e47fa5569de1f85ae01b52eb1963983e8f2fb9dc8e0511bf7357ad73f5
MD5 hash:
72798196a76873fbd69b0868e0bf8150
SHA1 hash:
d77ae50f56543c23eaa73c0790d0d3e332f0925e
Link:
https://www.unpac.me/results/e57559f6-42df-42ef-8b31-6c4a1a4869ad/
SH256 hash:
d0bc689366b419dc035bc7fff934d2c4e8b73f19e06d38aabf44c9e39d723510
MD5 hash:
baf26a9a9e834c91797471467abd7fcb
SHA1 hash:
82221b441d2e61f3536b2d3c8f14dd49695844d5
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/e57559f6-42df-42ef-8b31-6c4a1a4869ad/
Parent samples :
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SH256 hash:
75f6a7c7bd89503e8d124ea03e84189de8e5c40db7627ce107c6a9dd5f3dadfe
MD5 hash:
42ae66204215563c60023c4a6f73c9a4
SHA1 hash:
4208a13397755bc97b66ddbfbbfb8901ccf067a4
Detections:
RedLine_Campaign_June2021
Create hunting rule
Link:
https://www.unpac.me/results/e57559f6-42df-42ef-8b31-6c4a1a4869ad/
Parent samples :
6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e
SH256 hash:
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
MD5 hash:
82cdc3929a00fcb38376e0ab0e6e71c2
SHA1 hash:
384c2fab9badfa36e3af1df8827e51de06c5615d
Link:
https://www.unpac.me/results/e57559f6-42df-42ef-8b31-6c4a1a4869ad/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/44fa3b989b07/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/476563/

Comments