MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
SHA3-384 hash: 6c9e66a90ab674ec8058213a9db2aa10937d8a963f34e51447f948b91564be35a175f72e2267ae6c7bbd826edeedf9b1
SHA1 hash: 408549982b687ca8dd5efb0e8b704a374bd8909d
MD5 hash: 89ec2c6bf09ed9a38bd11acb2a41cd1b
humanhash: floor-march-crazy-artist
File name:file
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:401'544 bytes
First seen:2024-03-27 14:22:39 UTC
Last seen:2024-03-27 16:23:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:iSDt4gq9aVLevhc02f0/nndTHh3Ep2a7TL:5Dqg6hcR2ndTZe2a7TL
TLSH T1AE84120AB7EB4412C5495875C0D788160BF6ABCB33B3D54A398941D90F523D1AFEA3EE
TrID 66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.5% (.EXE) Win64 Executable (generic) (10523/12/4)
5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter Bitsight
Tags:exe RedLineStealer


Avatar
Bitsight
url: https://vk.com/doc329118071_676351514?hash=oPyw4gmGJJun6lU9sLErlqtdzmddNG56Nt55YfEENPc&dl=RCDwPdBUKrCPj7fUCgfOWpgDFGrhD5rBE6MQvUIUlHz&api=1&no_preview=1#1

Intelligence

File Origin
# of uploads :
3
# of downloads :
369
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d.exe
Verdict:
Malicious activity
Analysis date:
2024-03-27 14:23:52 UTC
Tags:
stealer redline
Link:
https://app.any.run/tasks/27afd5c6-9991-4bf0-8aa4-14655a0829ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Сreating synchronization primitives
Forced shutdown of a system process
Connection attempt to an infection source
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
net_reactor overlay packed packed
Link:
https://www.filescan.io/uploads/66042bc8c114c71235715a36/reports/cc13f9bd-d92b-4c11-a129-f8aa3e566853/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9a0c0bf7-acd6-4d19-a00b-7dfae663f7f0
Result
Threat name:
PureLog Stealer, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1416516
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2024-03-27 14:23:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ipbkxcgzjvsgqe5awnw3bjudqfynsjnfru5xwuf53zysqytmywq._file
Verdict:
malicious
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:logsdiller cloud (tg: @logsdillabot) discovery infostealer spyware stealer
Link:
https://tria.ge/reports/240327-rp5headh75/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
RedLine
RedLine payload
Malware Config
C2 Extraction:
5.42.65.0:29587
Unpacked files
SH256 hash:
ec7c1da33cb30c7546cc44a263fc7922c16248e45a1b299a863970540fe7f8cb
MD5 hash:
e804cefcf379b95067f4d9e6c3b1e6b2
SHA1 hash:
3346266c491eb876fa8f67f3e2a08f8bedeab13a
Detections:
redline
Create hunting rule
Link:
https://www.unpac.me/results/7dd2e032-efda-4e96-878f-6d1d72091982/
Parent samples :
da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
b72dd501577e9c1a22f9f5cee67e253353c1e1691fd981db7ee188f8c03d8c54
52c8947c40ed9f6facea49a5986f4232af6aadd73fbc395de25bfce50bc8a7e2
83a7e9e920ed3e08eca3c59f344fd603b1d4f1b65f19545862a1fa6aebe94d1a
d5d2a698d3e63631ef0e23dabec79f49e4173105eb267d2d59309a8c39c3ba52
f73a31c7e19e74128d45775a82f8df09150bcaef5bf3c98e2c29a2b90c275a67
7d06266d2ba7653d4ea295fa3e1df7a89b3194735e3cc3b5cd2964a3f4d1f730
a0efc003baef2a6eac1a1de2f130a08f8b7fcbf9a7e1bc01063cc405520f47bf
35feec04d26790253e1ad9417d19018bc888dc9275f46f80d5ac95050640ba02
b040d35e2eee0cdf7c3156106271a56b621f8ca1af9d24fcb22674c6a1f29fd1
e59d68eb85836c929b3a7d5363236be9c7769cea3a027422ef3647f036123bfd
d120ced38346298e6050d82c112c10fabbbd240b759212b545658c0e9289165b
SH256 hash:
da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
MD5 hash:
89ec2c6bf09ed9a38bd11acb2a41cd1b
SHA1 hash:
408549982b687ca8dd5efb0e8b704a374bd8909d
Link:
https://www.unpac.me/results/7dd2e032-efda-4e96-878f-6d1d72091982/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/da1e155c46ca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PureCrypter
Create hunting rule
Author:@bartblaze
Description:Identifies PureCrypter, .NET loader and obfuscator.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2794703/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments