MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 6 File information Comments 1

SHA256 hash:	99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
SHA3-384 hash:	431df420939cc16aa3a4dbffe69bd112a32066ddaf8ab168c66f3d63ae38c6cacddb04061fe171395441661200c13cca
SHA1 hash:	cc5a8a611d7cb4df5706225aa1d4ec494609e101
MD5 hash:	fbe0c71f5b2e640322d2716d8bc916a2
humanhash:	lithium-salami-ceiling-nineteen
File name:	fbe0c71f5b2e640322d2716d8bc916a2
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	481'280 bytes
First seen:	2024-02-16 18:54:03 UTC
Last seen:	2024-02-16 20:31:07 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	701b7eda6b324e6e9073377243e2004c (2 x RedLineStealer, 1 x Stealc, 1 x Smoke Loader)
ssdeep	12288:id6yhKSeU29mz2NbWcWnYp5M2an6kKSlzCa5:0KSK9mZMM2a6+lz7
TLSH	T108A4012032A6D032D14F22B58E34C7704EAE7C356561E9BF6FD25A3A6E24690DF2970D
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	3370ccd2ccf033da (36 x Smoke Loader, 10 x Stealc, 8 x GCleaner)
Reporter	zbetcheckin
Tags:	32 exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

347

Origin country :

Vendor Threat Intelligence

Detection:

MetaStealer

Link:

https://www.capesandbox.com/analysis/476540/

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.24480.19025.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Сreating synchronization primitives

Creating a process from a recently created file

Creating a file

Launching the default Windows debugger (dwwin.exe)

Connection attempt to an infection source

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a recently created process

Forced shutdown of a browser

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint packed

Link:

https://www.filescan.io/uploads/65cfaf87e304215defb2a913/reports/08efd26b-e8cc-4967-9624-b88139f27e63/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/83c11de3-57c8-41d5-92fa-8a795a614ff4

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1393666

Signature

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops PE files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-02-16 18:55:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=thnxmymvklqqqjvgec2dawsqsfnba6evel7tm2f6fzqrvn2ksupq._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/240216-xkr96sfa46/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

RedLine

RedLine payload

Unpacked files

SH256 hash:

b93b81e47fa5569de1f85ae01b52eb1963983e8f2fb9dc8e0511bf7357ad73f5

MD5 hash:

72798196a76873fbd69b0868e0bf8150

SHA1 hash:

d77ae50f56543c23eaa73c0790d0d3e332f0925e

Link:

https://www.unpac.me/results/956c09d9-1694-4495-a140-dc61997b4058/

SH256 hash:

d0bc689366b419dc035bc7fff934d2c4e8b73f19e06d38aabf44c9e39d723510

MD5 hash:

baf26a9a9e834c91797471467abd7fcb

SHA1 hash:

82221b441d2e61f3536b2d3c8f14dd49695844d5

Detections:

MAL_Malware_Imphash_Mar23_1

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/956c09d9-1694-4495-a140-dc61997b4058/

Parent samples :

6b3442f3867aad390ecbe493e952df11f40ae02727d068b4fcc2485513706257
99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f
f1f2fe4c421979d5bb23a3611a711e165b6b3d1785d9ad8ff58bc52ded4eab44
5240773ffa3a72a2d31a6a4aced652979b2662efaab2c7bcc28a1a67bd5b7696
44fa3b989b070dc438efd5460510fb3299806d4947750d0037120132c012e9b5
1fe7088b62bb734fbcf44343adb2f33a28acbb7d31103c65b02fc9af3fd4493d
f8c472c817f6c8a4dfffd64f338ae1c8c2c118e463f07558f2f7dd9838cc1fa2
8f1b88de3e26420aa653602243b5d82df9db524fb6148d6f993c31684f1d0c5e

SH256 hash:

75f6a7c7bd89503e8d124ea03e84189de8e5c40db7627ce107c6a9dd5f3dadfe

MD5 hash:

42ae66204215563c60023c4a6f73c9a4

SHA1 hash:

4208a13397755bc97b66ddbfbbfb8901ccf067a4

Detections:

RedLine_Campaign_June2021

Link:

https://www.unpac.me/results/956c09d9-1694-4495-a140-dc61997b4058/

Parent samples :

SH256 hash:

99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f

MD5 hash:

fbe0c71f5b2e640322d2716d8bc916a2

SHA1 hash:

cc5a8a611d7cb4df5706225aa1d4ec494609e101

Link:

https://www.unpac.me/results/956c09d9-1694-4495-a140-dc61997b4058/

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/99db76619552/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/99db76619552e10826a620b4305a50915a10789522ff3668be2e611ab74a951f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/