MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
SHA3-384 hash: c17bd20a130ca50b8bedfb5331367dcf3b9cacf07f2528c0f7d12fd9f872c7246cf8084cfb796868a9e9246b02786056
SHA1 hash: 17f5f8100f012683ce241a8b79e2553bfbb0b04a
MD5 hash: 2abf4a129acbe7320e56c47a8c918e34
humanhash: jupiter-summer-robert-eight
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:317'440 bytes
First seen:2024-04-06 14:19:48 UTC
Last seen:2024-04-06 15:09:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:f9pH1qN/rXsuI9IaeANXnpmS98GxJ6sE7AVLMHtxV5inBlny2goYEy9H:70Nz3I9Kk3IS8M6fkNIR5yy2geKH
TLSH T1D364233BEA3BA090DD0473B0DD75DD7078E956C05B35A5FD729F28A2D094BACAC27120
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter Bitsight
Tags:exe RedLineStealer


Avatar
Bitsight
url: https://vk.com/doc5294803_668332153?hash=OILq0lcrK4Z8sjrrKSLVWl8gTtvfXZkI1be0fHfzxVX&dl=SZzGZsUOooHt2NPJJdLxcsOWiaZiCSa1ztonbEmtNA8&api=1&no_preview=1#1

Intelligence

File Origin
# of uploads :
2
# of downloads :
335
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1.exe
Verdict:
Malicious activity
Analysis date:
2024-04-06 14:22:25 UTC
Tags:
stealer redline
Link:
https://app.any.run/tasks/3b4ce2bd-73b9-40b7-8e8a-497cfa59fc20

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/66115a13aeca3665d3b6d022/reports/63975439-5c8e-4a88-b52c-c8ea67a8c6cf/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/02f2a4e2-a941-4782-9930-0eaf16a7be91
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1421360
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1/
Threat name:
Win32.Trojan.RedLineStealer
Create hunting rule
Status:
Malicious
First seen:
2024-04-06 14:20:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbangxro5ygn67brkyige4nfnnrb7dfbv6osj7fsez2mnipst7iq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:logsdiller cloud (tg: @logsdillabot) discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240406-rneklacb8z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
5.42.65.0:29587
Unpacked files
SH256 hash:
ec7c1da33cb30c7546cc44a263fc7922c16248e45a1b299a863970540fe7f8cb
MD5 hash:
e804cefcf379b95067f4d9e6c3b1e6b2
SHA1 hash:
3346266c491eb876fa8f67f3e2a08f8bedeab13a
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/d47c93f3-5231-4213-bc6f-d1beb8c060a5/
Parent samples :
da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
b72dd501577e9c1a22f9f5cee67e253353c1e1691fd981db7ee188f8c03d8c54
52c8947c40ed9f6facea49a5986f4232af6aadd73fbc395de25bfce50bc8a7e2
83a7e9e920ed3e08eca3c59f344fd603b1d4f1b65f19545862a1fa6aebe94d1a
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
f73a31c7e19e74128d45775a82f8df09150bcaef5bf3c98e2c29a2b90c275a67
7d06266d2ba7653d4ea295fa3e1df7a89b3194735e3cc3b5cd2964a3f4d1f730
a0efc003baef2a6eac1a1de2f130a08f8b7fcbf9a7e1bc01063cc405520f47bf
35feec04d26790253e1ad9417d19018bc888dc9275f46f80d5ac95050640ba02
b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
e59d68eb85836c929b3a7d5363236be9c7769cea3a027422ef3647f036123bfd
d120ced38346298e6050d82c112c10fabbbd240b759212b545658c0e9289165b
SH256 hash:
b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
MD5 hash:
2abf4a129acbe7320e56c47a8c918e34
SHA1 hash:
17f5f8100f012683ce241a8b79e2553bfbb0b04a
Link:
https://www.unpac.me/results/d47c93f3-5231-4213-bc6f-d1beb8c060a5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b040d35e2eee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments