MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d31658e0fec53c1d98100d576418bbd1c1d3da46ce4aeadc181827a63ccd973a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d31658e0fec53c1d98100d576418bbd1c1d3da46ce4aeadc181827a63ccd973a
SHA3-384 hash: 034b5080d2301e6e33d3a28b89b00a7229ea448df1b9b6f786cf70e939eb32c01d26230c690cbf1ea08609299773c204
SHA1 hash: c834528c3eaa4f037179230f89e1400a19984f8d
MD5 hash: d1e2721997a49175744d36d9eaa2a946
humanhash: island-shade-eighteen-texas
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'512'592 bytes
First seen:2022-12-05 00:32:38 UTC
Last seen:2022-12-05 02:28:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 784f331f65fd93c249119b3a8e6ca469 (4 x RedLineStealer)
ssdeep 24576:GRcq0pCim0ecOnj10vcmwvMP+JQt8mLkhAjl+ANnvddoeVdbx:G/i9inj1a9HRttLCAj1nFS+5x
Threatray 222 similar samples on MalwareBazaar
TLSH T134652215A3D2C8BAD9D3033491AABF41263AFE3133AAE39BA7C5155EDD307D4182471B
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 71e8ccacc8c0e071 (1 x RedLineStealer)
Reporter andretavare5
Tags:exe RedLineStealer signed

Code Signing Certificate

Organisation:*.sartle.com
Issuer:Go Daddy Secure Certificate Authority - G2
Algorithm:sha256WithRSAEncryption
Valid from:2022-02-21T05:30:29Z
Valid to:2023-03-25T05:30:29Z
Serial number: 4c49eeed4561ba2b
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: ee910cc578c583c89eaa71044928b3394be100e9242cfc256866022a373ee8f5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://91.213.50.36/files/spacemen.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2022-12-05 00:33:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/05df0afd-6a11-4ba3-ac81-d4c59199ad54

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/342666/
Detection(s):
SecuriteInfo.com.Unwanted-Program.004d2a1d1.5498.25274.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Launching a process
Sending an HTTP GET request
Creating a file in the %temp% directory
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed zlob
Link:
https://www.filescan.io/uploads/638d3c3ed4d7598ad9047e12/reports/2377c584-00e3-40b9-ab76-533be0718202/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4e7202b9-2794-4971-8d49-b867c889004f
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1127632
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to hide a thread from the debugger
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 760356 Sample: file.exe Startdate: 05/12/2022 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic 2->31 33 Malicious sample detected (through community Yara rule) 2->33 35 Antivirus detection for URL or domain 2->35 37 6 other signatures 2->37 6 file.exe 17 2->6         started        process3 dnsIp4 19 www.sealicensing.com 6->19 21 gem9twla6xbkkmlk0pnbh5yosth2xrxe.8mzefdh7t 6->21 23 sealicensing.com 198.23.62.100, 443, 49703, 49704 STEADFASTUS United States 6->23 17 C:\Users\user\AppData\Local\...\advapi32.dll, PE32 6->17 dropped 39 Writes to foreign memory regions 6->39 41 Allocates memory in foreign processes 6->41 43 Injects a PE file into a foreign processes 6->43 11 ngentask.exe 6->11         started        14 fontview.exe 15 5 6->14         started        file5 signatures6 process7 dnsIp8 45 Found evasive API chain (may stop execution after checking system information) 11->45 47 Contains functionality to detect virtual machines (IN, VMware) 11->47 49 Found API chain indicative of debugger detection 11->49 59 4 other signatures 11->59 25 109.206.243.58, 49709, 81 AWMLTNL Germany 14->25 27 api.ip.sb 14->27 29 192.168.2.1 unknown unknown 14->29 51 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->51 53 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->53 55 Tries to harvest and steal browser information (history, passwords, etc) 14->55 57 Tries to steal Crypto Currency Wallets 14->57 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d31658e0fec53c1d98100d576418bbd1c1d3da46ce4aeadc181827a63ccd973a/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-12-05 00:33:10 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
15 of 26 (57.69%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2mlfryh6yu6b3gaqbvlwigf32ha5hwsgzzfovxaydat2mpgns45a._file
Verdict:
malicious
Similar samples:
1212ac208df0962b7d1347b0dadbbd54e83b9dd4d30c45f760544f27e9c0f7b5
RedLineStealer
13d19cf0f53c65faef0b0f569bfe7c0a740c9113a6c5a0441f9509b3db59bc54
RedLineStealer
2c3310a45db53d2bc092521b417c9434c919dce00876b386e39a5b7cffa3c58f
RedLineStealer
2c989418ee6df1ae08f2332ca25edc3c7ace2aa9f8ef710b80857c500b4f4c01
RedLineStealer
44593f2948e2800c83e9d21abb9759e206ea94385ee5c0ddc9dc6a3e4d09273d
RedLineStealer
616812fc478db8cb2f4be4aae6094fb9e93ca2449c9b0841beeb9f7960914437
RedLineStealer
9decea735b00c1885b133ce7b7350ae65ec33a1c9663ec22d34216e425b18168
RedLineStealer
ca23870a45d3be35420a930a5eece560dbc792734fe32df17430a3f8820abd68
RedLineStealer
cf944362d88ca9e50ddba1ac4661c6185e9d2be1727ec4c78bb003fa3f4a9309
RedLineStealer
e9d2fc84653ded9e3b6a95d30ac8c86cd7dae65319238c9810277bee34c4d5d6
RedLineStealer
+ 212 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/221205-av7fhsad46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8a79f0a0-1ffd-4f95-954a-2e1ffe046cca
Unpacked files
SH256 hash:
ec3e234803c080af812993c95a5474bba5845b446c941cb7c40af5e268039f3f
MD5 hash:
5c0c6e101946138a495b80363acb77aa
SHA1 hash:
0d017ac906fff4e0798a9c8e681c9b26ffb939ae
Link:
https://www.unpac.me/results/616aa1b9-735b-412b-9711-714352922657/
SH256 hash:
d31658e0fec53c1d98100d576418bbd1c1d3da46ce4aeadc181827a63ccd973a
MD5 hash:
d1e2721997a49175744d36d9eaa2a946
SHA1 hash:
c834528c3eaa4f037179230f89e1400a19984f8d
Link:
https://www.unpac.me/results/616aa1b9-735b-412b-9711-714352922657/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d31658e0fec5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.92
Link:
https://yomi.yoroi.company/submissions/d31658e0fec53c1d98100d576418bbd1c1d3da46ce4aeadc181827a63ccd973a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2443775/
Cape
Cape
https://www.capesandbox.com/analysis/342666/

Comments