MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 18

Intelligence 18 IOCs YARA 13 File information Comments

SHA256 hash:	8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01
SHA3-384 hash:	c0e5e59786e698e29ca97e61cfc5ff345b12fe5a1ee128733e1611adf78d2b8104b7e706de31e225af5404ae8742c2c4
SHA1 hash:	452eca629b9b0f939e3a6560f18d99e4a3918f08
MD5 hash:	49e00aa06eca4d6ace833bb6b276a87e
humanhash:	triple-whiskey-tango-freddie
File name:	setup.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	4'811'564 bytes
First seen:	2024-08-26 18:05:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep	98304:FL31Pijm0vbQ+fkFQ8h+msKQYGWHVmR0/QoA57YT:FL7AbQ4k1hxRHkoAGT
TLSH	T15426332923ACD509D27F8F78D0E950458778EA0A6C13DB0E0FCBE0761B577A1DA19A37
TrID	56.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.1% (.EXE) Win32 Executable (generic) (4504/4/1) 3.7% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	b2e179995cb65a5b (2 x RedLineStealer, 1 x Empyrean)
Reporter	aachum
Tags:	exe RedLineStealer

iamaachum

https://www.youtube.com/watch?v=eUaZ5anBACk => https://www.mediafire.com/folder/f1tcqh0gh3tuc/Atriada_Software

Intelligence

File Origin

# of uploads :

# of downloads :

416

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2024-08-26 18:08:07 UTC

Tags:

themida redline

Link:

https://app.any.run/tasks/5f077b2a-c03a-4b54-9196-4687d35ea6dd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Malware.Trojanx-9862538-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ccc40ce7ff3f5a063c0663

Tags:

Encryption Generic Infostealer Network Static Stealth Heur

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

Creating a window

Using the Windows Management Instrumentation requests

Reading critical registry keys

Сreating synchronization primitives

Creating a file

Connection attempt to an infection source

Sending a TCP request to an infection source

Stealing user critical data

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

keylogger obsidium overlay packed packed redline themidawinlicense

Link:

https://www.filescan.io/uploads/66ccc40b7c001577ee1db61b/reports/61e9d5a3-d20b-44c7-9f78-8ebb5fb4f9b9/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c6d32de2-7e78-498b-9918-31e61be47fec

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1499266

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Found malware configuration

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Suricata IDS alerts for network traffic

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01

Detection:

redline

Link:

https://mwdb.cert.pl/sample/8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01/

Threat name:

Win32.Trojan.RedlineStealer

Status:

Malicious

First seen:

2024-08-25 21:56:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=riv3tqlvpi2agswz4mpezbc7bjly7hvwwwecyohyqrmmundz5uaq._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline credential_access discovery evasion spyware stealer themida trojan

Link:

https://tria.ge/reports/240826-wpqrgayfrm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Reads user/profile data of web browsers

Themida packer

Credentials from Password Stores: Credentials from Web Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/05c45060-64f1-422f-aec3-7a01fcb10801

Unpacked files

SH256 hash:

dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a

MD5 hash:

c02a029c978f13b753c6b578b1588c75

SHA1 hash:

e125d59451e7f467bfd329a00a506decbcd91d83

Link:

https://www.unpac.me/results/38cca02b-2ed0-4799-8863-93f574641178/

SH256 hash:

8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01

MD5 hash:

49e00aa06eca4d6ace833bb6b276a87e

SHA1 hash:

452eca629b9b0f939e3a6560f18d99e4a3918f08

Detections:

MALWARE_Win_MetaStealer

Link:

https://www.unpac.me/results/38cca02b-2ed0-4799-8863-93f574641178/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_Redline_Stealer_V2 Create hunting rule
Author:	Varp0s

Rule name:	GenericRedLineLike Create hunting rule
Author:	Still
Description:	Matches RedLine-like stealer; may match its variants.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	MALWARE_Win_MetaStealer Create hunting rule
Author:	ditekSHen
Description:	Detects MetaStealer infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	redline_stealer_1 Create hunting rule
Author:	Nikolaos 'n0t' Totosis
Description:	RedLine Stealer Payload

Rule name:	SUSP_OneNote Create hunting rule
Author:	spatronn
Description:	Hard-Detect One

Rule name:	Windows_Generic_Threat_efdb9e81 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_RedLineStealer_6dfafd7b Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 8a2bb9c1757a34034ad9e31e4c845f0a578f9eb6b5882c38f88458ca3479ed01

(this sample)

Link

https://tria.ge/240826-wllcksxela/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample