MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddd665cdfaee564854bd60c7c0f23ca082c29e341b3159f8b5a3e4a5f152731f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	ddd665cdfaee564854bd60c7c0f23ca082c29e341b3159f8b5a3e4a5f152731f
SHA3-384 hash:	54730f7a161fe940981f6e2473470a40ed6e227273d59726e520b53b64e07bcd7ecd6581a9ac526b6831ce62e235a7a0
SHA1 hash:	27ca5a866175f5ae33f2f945010d089b6dae357d
MD5 hash:	37ab783a56c5199fd7b0f8bb074a79ac
humanhash:	oven-timing-idaho-neptune
File name:	receipt -_-Swift-pdf.tar.lz.rar
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	130'309 bytes
First seen:	2023-09-28 06:08:01 UTC
Last seen:	2023-09-28 06:30:30 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	1536:uQRVwSd2E0JkbdyucZVx2pucLjBAh+y3nJqO6+snqey6YStepOg4evnWOWkYg0QR:rs7Fx2pzTy3nJqxIza1ePWFI0QdJulw
TLSH	T1D6D312B1DC685C112BBBAF5B8232A46387FF6F141F148046C30BE5D0549807A975BBBE
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	payment rar RedLineStealer SWIFT

cocaman

Malicious email (T1566.001)
From: "Zulfiqar Ali <east@east-engineering.com>" (likely spoofed)
Received: "from [141.98.6.212] (unknown [141.98.6.212]) "
Date: "27 Sep 2023 14:14:10 +0200"
Subject: "Payment Slips Please confirm Receipt "
Attachment: "receipt -_-Swift-pdf.tar.lz.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	receipt -_-Swift-pdf.tar.lz.exe
File size:	344'064 bytes
SHA256 hash:	f4fbe44601948e2474ebb35261952b08fcf51a2b98cf79ec0a27fd39bda651f1
MD5 hash:	93aba80ef8c7ce6282497c48e7e7ccd8
MIME type:	application/x-dosexec
Signature	RedLineStealer

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/ddd665cdfaee564854bd60c7c0f23ca082c29e341b3159f8b5a3e4a5f152731f/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control greyware lolbin masquerade net_reactor packed

Link:

https://www.filescan.io/uploads/6515184333582f234e0569f4/reports/5e5f5398-2191-4517-983e-02f3043badb2/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/ddd665cdfaee564854bd60c7c0f23ca082c29e341b3159f8b5a3e4a5f152731f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ddd665cdfaee564854bd60c7c0f23ca082c29e341b3159f8b5a3e4a5f152731f/

Threat name:

Win32.Spyware.RedLine

Status:

Malicious

First seen:

2023-09-27 09:39:48 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 36 (47.22%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3xlgltp25zleqvf5mdd4b4r4ucbmfhrudmyvt6fvupskl4ksompq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/230928-hcc3yshh24/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/