MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0
SHA3-384 hash: f28f1187c4e8290ce5beaf655b94f24b257d9234471263d6bc67019640bf27e34ef74bb58153af2bc02b22e2bd27700d
SHA1 hash: f2fbe291ae4bcf67fca2d4a3b3f407bb116fec78
MD5 hash: 149bf87a5db576376e4313d5e38a096a
humanhash: crazy-bulldog-oven-fifteen
File name:149bf87a5db576376e4313d5e38a096a.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:273'920 bytes
First seen:2024-05-10 08:31:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3cfbf9e74e2e5e77b5b441f8ceeb35d8 (3 x Vidar, 2 x RedLineStealer, 1 x LummaStealer)
ssdeep 6144:YdcllhS4qdxjPxUUsOYyA8n2Ih3cWVy7JGBsgmmKU:ya/SNR+X8dhMp2sCKU
TLSH T1B144CF51B1C08072D93319364AE4EAB49E7EF9700FB25A9F7B950F7F4F302C29624666
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
332
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0.exe
Verdict:
Suspicious activity
Analysis date:
2024-05-10 09:32:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d9603dd9-d0d9-42ad-98da-891ea91d43fa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Keylogger.Pwsx-10029486-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint infostealer lolbin packed shell32 stealc
Link:
https://www.filescan.io/uploads/663ddb94df07636df8d39183/reports/34d6bb1e-8ffb-4816-8f41-d9489f3b4095/overview
Verdict:
Malicious
Labled as:
Ser.Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9b601a0f-75f2-411d-9a49-729bc38128f7
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1439461
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Contains functionality to inject code into remote processes
Found API chain indicative of debugger detection
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2024-05-09 14:52:59 UTC
File Type:
PE (Exe)
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t2scp5q4hm45q3purak5ym55jx7gpufeiw43ace7j6rkk5q2lcqa._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:5345987420 discovery infostealer
Link:
https://tria.ge/reports/240510-kfas4sch6v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
RedLine
RedLine payload
Malware Config
C2 Extraction:
https://pastebin.com/raw/KE5Mft0T
Unpacked files
SH256 hash:
9eb658a10274a8553c3f4b07dab5fb5ee56d3032fcd7432990bcc82fcfbcbb2f
MD5 hash:
9237805b95c57186c4b24545579c168a
SHA1 hash:
43b98ced873c1d8f1413b8dfba6074953232db0f
Detections:
redline
Create hunting rule
MetaStealer
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/18dbfcb7-9374-4d73-b691-60a9dbae6f63/
Parent samples :
ed5f8ceee34a51795789866886e8e996aa1fb11394b2bc78158a3d9ca79231e6
51a759f98a18ef3e6b4e91fa32dc5319ccc5121eb77ac28cfa0579d30af7d8e8
e0d83985f5c637c87f187565f5148e69b4906bccd0c01cbeae67b47629567fb3
ddfc10c0c7bc80e272f955267dd2a49873be091d1ba1572a8a643113f80d7f16
a227fd914e500a9e273c986130667bb4f2e55150cd98844550c3b4ead6b7fa53
9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0
SH256 hash:
9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0
MD5 hash:
149bf87a5db576376e4313d5e38a096a
SHA1 hash:
f2fbe291ae4bcf67fca2d4a3b3f407bb116fec78
Link:
https://www.unpac.me/results/18dbfcb7-9374-4d73-b691-60a9dbae6f63/
Malware family:
RedLine.E
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9ea427f61c3b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 9ea427f61c3b39d86df48815dc33bd4dfe67d0a445b9b0089f4fa2a5761a58a0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2840331/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments