MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05
SHA3-384 hash:	78f7af3bf187bf49db5b97c82abbbc9b33bebae846e7d271b6e479108abd4555f3c3c5983fd2604e6435e75bc5ffe903
SHA1 hash:	d6323118969c70e046e9d76df2cab9c495a19c1a
MD5 hash:	a1a2935b1e618d810a60a222d649e3c6
humanhash:	ceiling-berlin-yellow-carolina
File name:	pureland.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	271'360 bytes
First seen:	2023-03-03 08:43:12 UTC
Last seen:	2023-03-03 10:39:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'116 x AgentTesla, 20'118 x Formbook, 12'358 x SnakeKeylogger)
ssdeep	6144:xXajEvq61XgAroVU8KDEzPl/ocWCcYMOydU7rvNZHtisOM9:xuEv7XgArW0Ep/JQjHU7JttisZ
Threatray	113 similar samples on MalwareBazaar
TLSH	T17444F11C0B8DE622D2AE05BED8E32E924771C17BDA67E74EA98C6524141F3CF4E4161F
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f0cc86260686ccf0 (4 x RedLineStealer)
Reporter	iamdeadlyz
Tags:	162-55-188-117 exe PureLand RedLineStealer

Iamdeadlyz

From thepureland.io (impersonation of Rune Teller - https://store.steampowered.com/app/1944360/Rune_Teller/)
https://iamdeadlyz.gitbook.io/malware-research/march-2023/pureland-a-fake-project-related-to-the-sandbox-malspam
RedLineStealer C&C: 162.55.188.117:48958

Intelligence

File Origin

# of uploads :

# of downloads :

223

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

pureland.exe

Verdict:

Malicious activity

Analysis date:

2023-03-03 08:44:52 UTC

Tags:

rat redline

Link:

https://app.any.run/tasks/946ddb8d-f66c-49ca-925c-06b8a5af3a37

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/371338/

Detection(s):

SecuriteInfo.com.Saudi_Phish_Trojan.16183.2976.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

Creating a file

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm obfuscated packed phishing

Link:

https://www.filescan.io/uploads/6401b355bfec0852a68eb377/reports/0a35d792-f3ac-4141-a399-a343cf0c350b/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05

Malware family:

RedLine stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8d760dc4-5209-4e1e-a09a-1ace15d2d053

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1186377

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2023-03-03 09:02:01 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 25 (76.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xh6bhtuzgotlbh2niwgyo2y577bj3hyhu3j4tbwstr3sebyehqcq._file

Verdict:

malicious

RedLineStealer

4dc43e28a0587cac34a92bf41308483f0b29f9a10f5bad041a72bd84386c2199

RedLineStealer

9068c85943e9aa7c9f5e81b8d3ecfc5c626b393bb41a3cf491d79df8266741c2

RedLineStealer

a1c73c29733ff629000554498b2d9cad8f1fa9c7b34adeb3ef1afc4e6ac77a34

RedLineStealer

ca10c218c7ed12f56148c11d31a0698c8d232064faba12402c16b70f7e34bf55

RedLineStealer

d54c611206f44e7cad6d84e74601a2c68c29e49ebc4183b4cdf1002816a431b8

RedLineStealer

f8c08ee89c855a5c4667ca859e193e05ce5073c7b89e4f3d4fbf6bdb0c50f243

RedLineStealer

+ 103 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/230303-km6jcsgc2z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Uses the VBS compiler for execution

Unpacked files

SH256 hash:

151430053373dcfada91915a66ffe077a616e8487bec8ebebfff67f2b94b0d4a

MD5 hash:

ea89cf376e8a6fcd1ffd91af00df0fdd

SHA1 hash:

dc9b3119f30828b37c92f440e2f050d85cf076cb

Link:

https://www.unpac.me/results/34d14ade-c95f-4063-949b-eeefc6aa1103/

SH256 hash:

71098b8170ffab366a078b1c3d6cf0643f9643bceec6fa5f739903cb33656d99

MD5 hash:

d74401e26e604b33f9d7b17c75af3394

SHA1 hash:

d8fa94a41cbc41737587255ea238d2c489967af5

Detections:

redline

Link:

https://www.unpac.me/results/34d14ade-c95f-4063-949b-eeefc6aa1103/

SH256 hash:

b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05

MD5 hash:

a1a2935b1e618d810a60a222d649e3c6

SHA1 hash:

d6323118969c70e046e9d76df2cab9c495a19c1a

Link:

https://www.unpac.me/results/34d14ade-c95f-4063-949b-eeefc6aa1103/

Malware family:

RedLine.E

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b9fc13ce9933/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b9fc13ce9933a6b09f4d458d876b1dffc29d9f07a6d3c986d29c772207043c05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	pe_imphash Create hunting rule

Rule name:	Saudi_Phish_Trojan Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a trojan used in Saudi Aramco Phishing
Reference:	https://goo.gl/Z3JUAA

Rule name:	Saudi_Phish_Trojan_RID2E2F Create hunting rule
Author:	Florian Roth
Description:	Detects a trojan used in Saudi Aramco Phishing
Reference:	https://goo.gl/Z3JUAA