MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 20


Intelligence 20 IOCs YARA 10 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
SHA3-384 hash: b54ed1aa7e5d5e9403e957d4416e1e9c8e40e6f9872822c37fc5f53d46606e60117053781f1ece82b25d134a68919c3b
SHA1 hash: 1259e9f868d0d80ac09aadb9387662347cd4bd68
MD5 hash: 5d860e52bfa60fec84b6a46661b45246
humanhash: bluebird-monkey-white-august
File name:5d860e52bfa60fec84b6a46661b45246
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:304'128 bytes
First seen:2024-06-23 11:02:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:WqFFrqwIOGdTypEmz07sFPaF16CVyeR+LhdwT5TZMfvgZcZqf7D34NeqiOLCbBOy:tBIOG6hPPLd05TZaYcZqf7DI3L
Threatray 1'876 similar samples on MalwareBazaar
TLSH T100546C1873EC8910E57F4B79D470D67083B0EC52A957E31E5ED0ACAB3D36B80EA156B2
TrID 53.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
22.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
7.7% (.EXE) Win64 Executable (generic) (10523/12/4)
4.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.3% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
67772e72ea6536254aef5687a6eec2ac0337c81698239e8fbc109b953790be76.exe
Verdict:
Malicious activity
Analysis date:
2024-06-23 03:50:47 UTC
Tags:
amadey botnet stealer loader meta metastealer redline lumma themida remote xworm evasion exela smokeloader vodkagats python djvu ransomware stop raccoonclipper
Link:
https://app.any.run/tasks/831c893b-acfa-4f49-a044-ef04e5574bae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Malware.Trojanx-9862538-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=667800e842d9e703b84b502bwin7simulatehigh_evasion
Tags:
Generic Redlinesteal
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending an HTTP GET request to an infection source
Searching for analyzing tools
Launching a process
Creating a file
Searching for the window
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Forced shutdown of a browser
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
keylogger redline
Link:
https://www.filescan.io/uploads/667800e70bf5978c0b119d3f/reports/2068eeeb-c71f-4c98-aadf-bbc53c89fddc/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/87c32ea6-1ef8-439e-84da-6ce626ba2398
Result
Threat name:
LummaC, Amadey, LummaC Stealer, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1461238
Signature
AI detected suspicious sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Yara detected Amadeys stealer DLL
Yara detected LummaC Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1461238 Sample: yWny5Jds8b.exe Startdate: 23/06/2024 Architecture: WINDOWS Score: 100 44 facilitycoursedw.shop 2->44 46 moreapp4you.online 2->46 64 Snort IDS alert for network traffic 2->64 66 Multi AV Scanner detection for domain / URL 2->66 68 Found malware configuration 2->68 70 9 other signatures 2->70 8 yWny5Jds8b.exe 19 19 2->8         started        13 axplong.exe 2->13         started        15 axplong.exe 2->15         started        17 6 other processes 2->17 signatures3 process4 dnsIp5 54 185.215.113.67, 40960, 49731 WHOLESALECONNECTIONSNL Portugal 8->54 56 77.91.77.81, 49739, 49759, 49760 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 8->56 58 moreapp4you.online 31.31.196.208, 443, 49734 AS-REGRU Russian Federation 8->58 38 C:\Users\user\AppData\Local\Temp\7.exe, PE32 8->38 dropped 40 C:\Users\user\AppData\Local\Temp\6.exe, PE32 8->40 dropped 42 C:\Users\user\AppData\...\yWny5Jds8b.exe.log, ASCII 8->42 dropped 88 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->88 90 Found many strings related to Crypto-Wallets (likely being stolen) 8->90 92 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->92 100 2 other signatures 8->100 19 7.exe 4 8->19         started        23 6.exe 8->23         started        26 chrome.exe 1 8->26         started        94 Hides threads from debuggers 13->94 96 Tries to detect sandboxes / dynamic malware analysis system (registry check) 13->96 98 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 13->98 file6 signatures7 process8 dnsIp9 36 C:\Users\user\AppData\Local\...\axplong.exe, PE32 19->36 dropped 72 Antivirus detection for dropped file 19->72 74 Detected unpacking (changes PE section rights) 19->74 76 Machine Learning detection for dropped file 19->76 84 5 other signatures 19->84 28 axplong.exe 12 19->28         started        48 facilitycoursedw.shop 172.67.144.241, 443, 49740, 49741 CLOUDFLARENETUS United States 23->48 78 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 23->78 80 Query firmware table information (likely to detect VMs) 23->80 82 Found many strings related to Crypto-Wallets (likely being stolen) 23->82 86 5 other signatures 23->86 50 192.168.2.4, 138, 40960, 443 unknown unknown 26->50 52 239.255.255.250 unknown Reserved 26->52 31 chrome.exe 26->31         started        34 chrome.exe 26->34         started        file10 signatures11 process12 dnsIp13 102 Antivirus detection for dropped file 28->102 104 Detected unpacking (changes PE section rights) 28->104 106 Tries to detect sandboxes and other dynamic analysis tools (window names) 28->106 108 6 other signatures 28->108 60 iplogger.co 104.21.82.93, 443, 49742 CLOUDFLARENETUS United States 31->60 62 www.google.com 142.250.185.132, 443, 49754, 53705 GOOGLEUS United States 34->62 signatures14
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
Detection:
redline
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30/
Threat name:
ByteCode-MSIL.Trojan.Whispergate
Create hunting rule
Status:
Malicious
First seen:
2024-06-22 23:30:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wsq6i4hycs546g6cnqeh5nit6s5lmfs4sdwpiowhdxmhoaswdqya._file
Verdict:
malicious
Similar samples:
3835fe3e13b67d406cc7c1412098bbf2fcb28371c6628539ddf46d98aa716ef2
RedLineStealer
665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c
RedLineStealer
7d06266d2ba7653d4ea295fa3e1df7a89b3194735e3cc3b5cd2964a3f4d1f730
RedLineStealer
b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f
RedLineStealer
bfad83fe5b7277309e29ae2c92258a9df03d0a4318f39ef588de9036fa316f6f
RedLineStealer
f9f26f3c687120f93ab59220634acb9ce2f6e0094bd076da4870080590a2bb34
RedLineStealer
+ 1'866 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:exelastealer family:lumma family:monster family:redline botnet:ama botnet:e76b71 botnet:livetraffic defense_evasion discovery evasion execution infostealer persistence privilege_escalation spyware stealer themida trojan
Link:
https://tria.ge/reports/240623-m5n35ssfmj/
Behaviour
Checks SCSI registry key(s)
Collects information from the system
Enumerates processes with tasklist
Enumerates system info in registry
Gathers network information
Gathers system information
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies registry key
Runs net.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Program crash
Drops file in Windows directory
Launches sc.exe
Hide Artifacts: Hidden Files and Directories
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Disables Task Manager via registry modification
Downloads MZ/PE file
Modifies Windows Firewall
Grants admin privileges
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Detects Monster Stealer.
Exela Stealer
Lumma Stealer
Monster
RedLine
RedLine payload
Malware Config
C2 Extraction:
185.215.113.67:40960
http://77.91.77.81
4.185.27.237:13528
https://facilitycoursedw.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://disappointcredisotw.shop/api
https://doughtdrillyksow.shop/api
https://parallelmercywksoffw.shop/api
https://liabiliytshareodlkv.shop/api
https://notoriousdcellkw.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://barebrilliancedkoso.shop/api
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e0f0fcfa-e82b-4c5c-8735-9b3ff1f52a63
Unpacked files
SH256 hash:
b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
MD5 hash:
5d860e52bfa60fec84b6a46661b45246
SHA1 hash:
1259e9f868d0d80ac09aadb9387662347cd4bd68
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/21a7d432-b34b-4515-bd35-54432c92d815/
Malware family:
Lumma
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4a1e470f814/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:GenericRedLineLike
Create hunting rule
Author:Still
Description:Matches RedLine-like stealer; may match its variants.
Rule name:MALWARE_Win_MetaStealer
Create hunting rule
Author:ditekSHen
Description:Detects MetaStealer infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Generic_Threat_efdb9e81
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Generic_40899c85
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_6dfafd7b
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2902306/
  
URLhaus
https://urlhaus.abuse.ch/url/2902308/
  
URLhaus
https://urlhaus.abuse.ch/url/2902310/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments


Avatar
zbet commented on 2024-06-23 11:02:55 UTC

url : hxxp://77.91.77.82/lend/ama.exe