MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 591862d94a476dc02982ee1d8e59eae169e10b51ab7bc13779e91218de49f414. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 29 File information Comments

SHA256 hash:	591862d94a476dc02982ee1d8e59eae169e10b51ab7bc13779e91218de49f414
SHA3-384 hash:	29088261de258d25dd1cbfdc254afe5bef239e40cd6482f022afab1e3459e670e1115b234ec636541c6b791e605c86bb
SHA1 hash:	44998f5c4aeba9c269a46680d10effcb13326fa8
MD5 hash:	9013febf3d6a31e157e2d329241dc9f6
humanhash:	harry-mars-white-victor
File name:	winPEASx64_ofs.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	1'893'376 bytes
First seen:	2023-08-20 21:16:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:dW/3Fv18zjT+CrH6t3YDk418HQMss0ivPUsxF2:dW/3Oat14GwivPUs
Threatray	20 similar samples on MalwareBazaar
TLSH	T101954A016BD89A61EABF5B34A87111448777F462D67AEB0F338C80A41F7BB409C92777
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	ULTRAFRAUD
Tags:	exe Redline RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

333

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

winPEASx64_ofs.exe

Verdict:

Malicious activity

Analysis date:

2023-08-20 21:18:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/31dbec69-5961-460b-9736-4ad6b6bdc610

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/443851/

Detection(s):

Win.Worm.VB-698

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Creating a file

Launching a process

Creating a window

Searching for synchronization primitives

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/591862d94a476dc02982ee1d8e59eae169e10b51ab7bc13779e91218de49f414

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f4ee2684-6f82-454c-a949-09202729d751

Result

Threat name:

PEASS HackTool

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1294181

Signature

Accesses ntoskrnl, likely to find offsets for exploits

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive printer information (via WMI, Win32_Printer, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Queries sensitive share information (via WMI, WIN32_SHARE, often done to detect sandboxes)

Queries sensitive share information (via WMI, Win32_Share, often done to detect virtual machines)

Sigma detected: Capture Wi-Fi password

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Uses netsh to modify the Windows network and firewall settings

Very long command line found

Yara detected AntiVM3

Yara detected PEASS HackTool

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/591862d94a476dc02982ee1d8e59eae169e10b51ab7bc13779e91218de49f414/

Threat name:

ByteCode-MSIL.Spyware.RedLine

Status:

Malicious

First seen:

2023-07-04 04:08:29 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lemgfwkki5w4akmc5yoy4wpk4fu6cc2rvn54cn3z5ejbrxsj6qka._file

Verdict:

malicious

RedLineStealer

425c0e99221b064d1577ac907a4803d14f4e67a305742aa2c1e80382b967831b

RedLineStealer

623e57f2138f869c8a093760721a1116489ff00099237d3942d9bf8ebe91f55c

RedLineStealer

7480bd6a54b0197851bc35b0e4b7a330336348c0ecaa4f2f0c67f28c16a7488c

RedLineStealer

a290ce75c6c6b37af077b72dc9c2c347a2eede4fafa6551387fa8469539409c7

RedLineStealer

af9fe480abc56cf1e1354eb243ec9f5bee9cac0d75df38249d1c64236132ceab

RedLineStealer

b0409e5acf0d927f046c33befc48b2653ad0ee098e2d4a5764eb9af8126e539f

RedLineStealer

e4492142e62dce45138b0f0c6c93032c02c2c1a2b413ad6d1c8c1d77c803f8c3

RedLineStealer

f8ffc252796874ef35f1da7be7a7eb081905f81863cda673513aa422fde9b8d7

RedLineStealer

+ 10 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230820-z4f3csba91/

Behaviour

Gathers system information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Enumerates connected drives

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

591862d94a476dc02982ee1d8e59eae169e10b51ab7bc13779e91218de49f414

MD5 hash:

9013febf3d6a31e157e2d329241dc9f6

SHA1 hash:

44998f5c4aeba9c269a46680d10effcb13326fa8

Link:

https://www.unpac.me/results/9b6dd248-5a99-4889-a0f8-fc53e86dd5b5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/591862d94a476dc02982ee1d8e59eae169e10b51ab7bc13779e91218de49f414

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects .NET red/black-team tools via typelibguid
Reference:	https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite

Rule name:	hunt_credaccess_iis_xor Create hunting rule
Author:	SBousseaden
Description:	hunt for strings related to iis credential access

Rule name:	INDICATOR_EXE_Packed_Dotfuscator Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Dotfuscator

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing URLs to raw contents of a Github gist

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_References_SecTools Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many IR and analysis tools

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Windows_Hacktool_Seatbelt_674fd535 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Hacktool_WinPEAS_ng_23fee092 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File analysis module

Rule name:	Windows_Hacktool_WinPEAS_ng_413caa6b Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, event module

Rule name:	Windows_Hacktool_WinPEAS_ng_4a9b9603 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Services info module

Rule name:	Windows_Hacktool_WinPEAS_ng_4db2c852 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, System info module

Rule name:	Windows_Hacktool_WinPEAS_ng_57587f8c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Network module

Rule name:	Windows_Hacktool_WinPEAS_ng_66197d54 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, application module

Rule name:	Windows_Hacktool_WinPEAS_ng_861d3264 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File Info module

Rule name:	Windows_Hacktool_WinPEAS_ng_b6bb3e7c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Windows credentials module

Rule name:	Windows_Hacktool_WinPEAS_ng_bcedc8b2 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, User info module

Rule name:	Windows_Hacktool_WinPEAS_ng_cae025b1 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Process info module

Rule name:	Windows_Hacktool_WinPEAS_ng_e8ed269c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, checks module