MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 6 File information Comments

SHA256 hash:	5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
SHA3-384 hash:	e5bc2fb007dc6aa6ce1b0ac85ef6fd72e802f86521c6c6d83d2451956f33d7579928d623a9d2f1585906b10fc6a73d2a
SHA1 hash:	1213df1776390d5a9acd3395f0b806bbae13127f
MD5 hash:	344ab5f6badfc8e09e9b8384f5cb3e60
humanhash:	florida-don-georgia-diet
File name:	SecuriteInfo.com.Win32.TrojanX-gen.31581.31589
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	475'648 bytes
First seen:	2024-02-17 00:39:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ab4b20db27905f9ef383a4e0564b2b9d (3 x RedLineStealer)
ssdeep	12288:fdhvZeiD9j3AaVZ3r1l5D/Ei1t1egcCpRScNsuCWJuffs:fdhBD9jjZ3rJLX0gcm9GuCWoff
Threatray	7 similar samples on MalwareBazaar
TLSH	T191A4F11023A0D036D29352B5C635C7B00FFB387235B2A98E7B96667D2F36791832971E
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	3370ccd2ccf033da (36 x Smoke Loader, 10 x Stealc, 8 x GCleaner)
Reporter	SecuriteInfoCom
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

317

Origin country :

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/476559/

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.31581.31589.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint packed

Link:

https://www.filescan.io/uploads/65d00064b7fbcf60a4731667/reports/8354da97-d8e7-4876-802c-0cfbc9fedc11/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/79a72387-75c1-4295-a709-d857fd1cf72e

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.adwa.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1393780

Signature

.NET source code contains very large array initializations

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops PE files to the startup folder

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-02-17 00:40:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 23 (65.22%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kjahop72hjzkfuy2njfm5vsss6nsmyxpvkzmppgcringppk3o2la._file

Verdict:

malicious

RedLineStealer

6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257

RedLineStealer

99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f

RedLineStealer

f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44

RedLineStealer

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/240217-az7xvahg65/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

RedLine

RedLine payload

Unpacked files

SH256 hash:

b93b81e47fa5569de1f85ae01b52eb1963983e8f2fb9dc8e0511bf7357ad73f5

MD5 hash:

72798196a76873fbd69b0868e0bf8150

SHA1 hash:

d77ae50f56543c23eaa73c0790d0d3e332f0925e

Link:

https://www.unpac.me/results/d56cbcfd-d8d3-4cf7-9cd2-efc76609fa2e/

SH256 hash:

d0bc689366b419dc035bc7fff934d2c4e8b73f19e06d38aabf44c9e39d723510

MD5 hash:

baf26a9a9e834c91797471467abd7fcb

SHA1 hash:

82221b441d2e61f3536b2d3c8f14dd49695844d5

Detections:

MAL_Malware_Imphash_Mar23_1

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/d56cbcfd-d8d3-4cf7-9cd2-efc76609fa2e/

Parent samples :

6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e

SH256 hash:

75f6a7c7bd89503e8d124ea03e84189de8e5c40db7627ce107c6a9dd5f3dadfe

MD5 hash:

42ae66204215563c60023c4a6f73c9a4

SHA1 hash:

4208a13397755bc97b66ddbfbbfb8901ccf067a4

Detections:

RedLine_Campaign_June2021

Link:

https://www.unpac.me/results/d56cbcfd-d8d3-4cf7-9cd2-efc76609fa2e/

Parent samples :

SH256 hash:

5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696

MD5 hash:

344ab5f6badfc8e09e9b8384f5cb3e60

SHA1 hash:

1213df1776390d5a9acd3395f0b806bbae13127f

Link:

https://www.unpac.me/results/d56cbcfd-d8d3-4cf7-9cd2-efc76609fa2e/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5240773ffa3a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/