MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
SHA3-384 hash: 4bfa60ffeffdffc4d4c8544251d199505d5390f39e6eea0c30503bb798d1921efd46303d7a98ab5f92ec94dc863ace0e
SHA1 hash: 4309f3b9cbaafb909c9cf1cf85503c6cfa71b565
MD5 hash: 9ef39d6f27e41fc29f9d10acfa5a17c9
humanhash: asparagus-quiet-harry-july
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:339'592 bytes
First seen:2024-04-01 13:51:23 UTC
Last seen:2024-04-01 14:28:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:2UNT52ujFIdj3e3zpQiaRdY2zZxbkHmNeM7AttjUoM/:BT5ZjFWDebEjzkoqe/
TLSH T1D87423B2C37C4602DCB6C8B136DDA249EDFDF389280582765AA5F2C55B263C9E750339
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter Bitsight
Tags:exe RedLineStealer


Avatar
Bitsight
url: https://vk.com/doc329118071_676518961?hash=pw6KyWKM8eioCu0zgZmEazdOtTvZ5mvssh7SiWI10dP&dl=MZlS7RZjnkibzXn4KvH5BEdJxz6hghet0iI5z8wg6xc&api=1&no_preview=1#1

Intelligence

File Origin
# of uploads :
3
# of downloads :
371
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52.exe
Verdict:
Malicious activity
Analysis date:
2024-04-01 14:26:52 UTC
Tags:
stealer redline
Link:
https://app.any.run/tasks/d0245782-61d7-49d0-baca-c7123bc8a2c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/660abc03d463a7b04778e62c/reports/8e504866-2cf9-4256-a4b8-8d2169f9e4b4/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c39d19fa-57f1-4254-a361-314ca4296918
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1418190
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
22%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2024-04-01 13:52:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xjknggt4y3dd3yoepnl5r47jhsbomif5mth2lkzgcniyoodxjja._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:logsdiller cloud (tg: @logsdillabot) discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240401-q6dkksfd4w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
5.42.65.0:29587
Unpacked files
SH256 hash:
ec7c1da33cb30c7546cc44a263fc7922c16248e45a1b299a863970540fe7f8cb
MD5 hash:
e804cefcf379b95067f4d9e6c3b1e6b2
SHA1 hash:
3346266c491eb876fa8f67f3e2a08f8bedeab13a
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/079a93e2-8bba-4f7c-913e-ef6f84c3dbf5/
Parent samples :
da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
b72dd501577e9c1a22f9f5cee67e253353c1e1691fd981db7ee188f8c03d8c54
52c8947c40ed9f6facea49a5986f4232af6aadd73fbc395de25bfce50bc8a7e2
83a7e9e920ed3e08eca3c59f344fd603b1d4f1b65f19545862a1fa6aebe94d1a
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
f73a31c7e19e74128d45775a82f8df09150bcaef5bf3c98e2c29a2b90c275a67
7d06266d2ba7653d4ea295fa3e1df7a89b3194735e3cc3b5cd2964a3f4d1f730
a0efc003baef2a6eac1a1de2f130a08f8b7fcbf9a7e1bc01063cc405520f47bf
35feec04d26790253e1ad9417d19018bc888dc9275f46f80d5ac95050640ba02
b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
e59d68eb85836c929b3a7d5363236be9c7769cea3a027422ef3647f036123bfd
d120ced38346298e6050d82c112c10fabbbd240b759212b545658c0e9289165b
SH256 hash:
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
MD5 hash:
9ef39d6f27e41fc29f9d10acfa5a17c9
SHA1 hash:
4309f3b9cbaafb909c9cf1cf85503c6cfa71b565
Link:
https://www.unpac.me/results/079a93e2-8bba-4f7c-913e-ef6f84c3dbf5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d5d2a698d3e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments