MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments

SHA256 hash:	bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
SHA3-384 hash:	f03a1044fae6ad4f680cfe6eaab41183515b097290ae12fe153d8f48c62bde85595af9f5b726a6cb42eef2c79c556a45
SHA1 hash:	04de18289a6a5c8050c34f8c1c55f84a29da4cc2
MD5 hash:	5d292e2f93b3c930e9b1acc52364f755
humanhash:	lamp-mississippi-may-south
File name:	Overdue-invoices-Statement-09202024.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	807'765 bytes
First seen:	2024-09-20 13:56:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	890e522b31701e079a367b89393329e6 (25 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep	24576:tthEVaPqLD+EaZROtz07UZAjfAAk+Ytd3:VEVUcyBZyz04ZC4Vd3
Threatray	775 similar samples on MalwareBazaar
TLSH	T16E053393B6A4B422E8F41774D1E38B82DAA07691B37C467F6104260B4CCF1259DBBF2D
TrID	86.7% (.EXE) AutoIt3 compiled script executable (510622/80/67) 4.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla)
Reporter	Anonymous
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

424

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Overdue-invoices-Statement-09202024.exe

Verdict:

No threats detected

Analysis date:

2024-09-20 14:04:18 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/49d5be8a-a5f0-4789-a53a-bd29263e50c1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.PSW.Banker6.BTQY.1690.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66ed7f2ff129e67ada90185b

Tags:

Encryption Stealth Trojan Heur

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Сreating synchronization primitives

DNS request

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm autoit lolbin masquerade microsoft_visual_cc monero overlay packed packed packed shell32 upx

Link:

https://www.filescan.io/uploads/66ed7f30043c09361a309a0e/reports/32d36a5e-09f5-483d-915e-9dd2b1148153/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7aa18cbd-7d67-4e66-96b0-a115b7d51ef2

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1514535

Signature

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d/

Threat name:

Win32.Spyware.Snakekeylogger

Status:

Malicious

First seen:

2024-09-20 13:23:26 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x2qjceuaznh66bq5y4h6j65u6xejofvmnuc3ppjyhlszhwqrnuoq._file

Verdict:

malicious

Label(s):

admintool_powerrun

RedLineStealer

104d9edec97eb16b20380e92ec10a7dff27e64de1ff2d8eefa764a4aa8648242

RedLineStealer

27c0352770c45cc190f6edee81ecb8f1d0a4388fe33d7e6f0e9e72ac35c02141

RedLineStealer

8a186f546c36a34567b695addfb776f2c2df584535a133fdf3ca699d4ec64e38

RedLineStealer

bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d

RedLineStealer

ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5

RedLineStealer

cbb36fbfcd50f2c2815f2031dc3b77aff8d837d5dd9bb807f330394c7799168f

RedLineStealer

e5aebbb2c6ad445d5a2ee5c33a77d8ecfe74cf206433b723736e2e88b9b5d78f

RedLineStealer

+ 765 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger discovery keylogger stealer upx

Link:

https://tria.ge/reports/240920-q8849szdka/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Loads dropped DLL

UPX packed file

VIPKeylogger

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b144950b-d32f-49e0-8db8-071d0db93b0d

Unpacked files

SH256 hash:

83f4ac0157bf747c85d5bbce6ce3099e0861ce7cab40cfeeba282d4c4313d497

MD5 hash:

b175c6f76f144025ac54e99ea308178d

SHA1 hash:

eda0d90aa2a0fe7ea823e8fe6a4db6b5f06f2149

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/e57413b4-7aba-49b7-aab1-afa282c6b107/

Parent samples :

ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
0812c989fb4ccd9ecc95deacd727da799b88ae487e0edd4dcee900429a420065
4237d59dc3ae1263c38b45de37e7f6d5a13223cb2166fea0394a5593dd7f5520
b43ad962fd2871e8d704ed4b44f719dee7793e90387563292fe48744d86a4e54
958e5d7947f48f2047ac3c595ee724a916c9969430731091ac1b9fcfaaf65d70
77db8dd22b4534f98b39125e98d0aa8448bae16313b61d18383c420569f6af7a
ab158b7e9b371e301d2554b7eb3f6363cdc88efc65397343d3ef179db7e0d68a
996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12
8f1be325faa69592642419a3ce86343a7b484853d0a1b27bd769f8435be85381
0a0777441380c8bff668c4ef87b88334f9b26c3d45f3a9b2a4059cc893cb3244
57be4ec7980a2d28a02541067688d47feecf59e71fdb022aa93fe84c04429c55

SH256 hash:

7197ad45a3aa6ac5806c082220503f9b7a454328b082980d80776cc828ddc842

MD5 hash:

d87cfbefcd076cdce3d8d73da7e684ce

SHA1 hash:

787a1bdcbb30e49f76d40280ceaa24d3cf579628

Detections:

win_404keylogger_g1

MAL_Envrial_Jan18_1

Link:

https://www.unpac.me/results/e57413b4-7aba-49b7-aab1-afa282c6b107/

Parent samples :

bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
72037d434873dc904c7a9272b76ad931424d6ac36cae1e3505c39d0e2912ac9b

SH256 hash:

4ce484f6aeaf1754b945ab840460e109c7e2b619124235784d19f125cc2db2a2

MD5 hash:

b7beae22af057eba12994bd2c94c788c

SHA1 hash:

60abb4e81cd15f3ab1ffe60289ffe4448821fcf6

Detections:

win_404keylogger_g1

MAL_Envrial_Jan18_1

Link:

https://www.unpac.me/results/e57413b4-7aba-49b7-aab1-afa282c6b107/

Parent samples :

bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
72037d434873dc904c7a9272b76ad931424d6ac36cae1e3505c39d0e2912ac9b

SH256 hash:

de049f5a6f360fd78f5992e9750e5d4bd78afe171f0166e87a9acdfd8bfb4b35

MD5 hash:

64826fbeebc05e354abbc67d4c6405c5

SHA1 hash:

d3fba95bd5b1ccc95246fd87d53746aa1b3b7e94

Detections:

win_samsam_auto

MAL_Malware_Imphash_Mar23_1

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

Link:

https://www.unpac.me/results/e57413b4-7aba-49b7-aab1-afa282c6b107/

Parent samples :

bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d
72037d434873dc904c7a9272b76ad931424d6ac36cae1e3505c39d0e2912ac9b

SH256 hash:

bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d

MD5 hash:

5d292e2f93b3c930e9b1acc52364f755

SHA1 hash:

04de18289a6a5c8050c34f8c1c55f84a29da4cc2

Detections:

MAL_Malware_Imphash_Mar23_1

Link:

https://www.unpac.me/results/e57413b4-7aba-49b7-aab1-afa282c6b107/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bea0911280cb4fef061dc70fe4fbb4f5c89716ac6d05b7bd383ae593da116d1d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::GetAce
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::timeGetTime
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample