MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments

SHA256 hash:	5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa
SHA3-384 hash:	2ccd3f65997034dee1ceb9769c8964903b474f02b0b14edf895e79d37befb60ae6358eaff52a73a0e11d1ac4888920d1
SHA1 hash:	b0e595390c77b313a08a81df366a2ba3f8e683b4
MD5 hash:	4b4106cbe0cbf4ca771a185abaf54362
humanhash:	eleven-sierra-river-georgia
File name:	ENDIDEV.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	189'440 bytes
First seen:	2024-04-17 21:11:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bf5a4aa99e5b160f8521cadd6bfe73b8 (436 x RedLineStealer, 31 x AgentTesla, 17 x DCRat)
ssdeep	3072:fDKW1LgppLRHMY0TBfJvjcTp5XGGnH/K+Q9jCL:fDKW1Lgbdl0TBBvjc/L9Q5y
TLSH	T14304AD2171C0C1B3C4BB113444E6CA799A7A70714B7A95DBB6DD2BBA6F103E1A3362CD
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	Anonymous
Tags:	exe Kamrui Redline RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

573

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa.exe

Verdict:

No threats detected

Analysis date:

2024-04-17 21:13:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c08c408a-0a81-4d55-9b3d-5dce07fda021

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Launching a process

Moving a file to the Program Files subdirectory

Replacing files

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint packed

Link:

https://www.filescan.io/uploads/66203b22c5dabc22b2019372/reports/f64b6c6d-047a-4f51-bbcb-9e872a74aa68/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d90c5bd9-422f-47bf-ae7a-446ddb8d6370

Result

Threat name:

PureLog Stealer, RedLine

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1427668

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2023-09-18 20:04:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lvjj5ow7snoqohgwjwl2wrm2uetwnlyqmpfs7qdhz724cgg76l5a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/240417-z16hvaec24/

Behaviour

Suspicious use of AdjustPrivilegeToken

.NET Reactor proctector

Unpacked files

SH256 hash:

393cd7cf1e7d9b487d3c80901b32559dc6883bd3fa2df5605a93f2e72f9ec1f2

MD5 hash:

549e5de131a14f1a92966325f290e286

SHA1 hash:

959b40e773570d4e062b26ac6f855dc79f68b872

Detections:

INDICATOR_EXE_Packed_DotNetReactor

RedLine_Campaign_June2021

Link:

https://www.unpac.me/results/460d7b6d-6005-4c6d-b23e-fa8d43e09883/

SH256 hash:

fa45063a618526d9c289220b9572c9339231f5e1843153c187e9e10741d9bf09

MD5 hash:

12dcedb5a298ab9a5c7fc6e42265075d

SHA1 hash:

943883c65c02343381324b7453417dd6a3fd44ad

Detections:

INDICATOR_EXE_Packed_DotNetReactor

Link:

https://www.unpac.me/results/460d7b6d-6005-4c6d-b23e-fa8d43e09883/

SH256 hash:

5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa

MD5 hash:

4b4106cbe0cbf4ca771a185abaf54362

SHA1 hash:

b0e595390c77b313a08a81df366a2ba3f8e683b4

Detections:

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/460d7b6d-6005-4c6d-b23e-fa8d43e09883/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5d529ebadf93/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample