MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee
SHA3-384 hash: d71fb75cb41be452b61dc493100ed867be0dc3c9438ab4740b09089f39668756827173f539da07de936d2b44b1838c63
SHA1 hash: c87d4ebc83d8efa8fa31e60f79e83205d436803c
MD5 hash: c30f0328acefe083da339f7969a0fc3f
humanhash: mountain-kitten-zebra-connecticut
File name:New shipment AWB NO - 09804480383.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'144'832 bytes
First seen:2024-11-25 02:25:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:0tb20pkaCqT5TBWgNQ7al/psVTZa7VVxVxo6A:dVg5tQ7al/puZa7Vjc5
Threatray 1'362 similar samples on MalwareBazaar
TLSH T1FD35CF1273DEC360C7B25273BA167701AEBF782506B5F96B2FD4093DE920122525EA73
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter threatcat_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
447
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New shipment AWB NO - 09804480383.exe
Verdict:
Malicious activity
Analysis date:
2024-11-25 02:25:36 UTC
Tags:
evasion snake keylogger netreactor ims-api generic
Link:
https://app.any.run/tasks/765e70c9-71cc-4aba-9ebf-81c3d965f324

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6743e03bb31374f098342164
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit compiled-script evasive fingerprint keylogger lolbin masquerade microsoft_visual_cc msconfig packed packed packer_detected
Link:
https://www.filescan.io/uploads/6743e03a426b648292f3ed84/reports/19f5eaa5-d537-4787-86b4-b4febbe869c4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e6684c48-1a82-463a-9521-c4048c1a8b9e
Result
Threat name:
PureLog Stealer, Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1562003
Signature
.NET source code contains method to dynamically call methods (often used by packers)
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1562003 Sample: New shipment  AWB NO - 0980... Startdate: 25/11/2024 Architecture: WINDOWS Score: 100 26 reallyfreegeoip.org 2->26 28 checkip.dyndns.org 2->28 30 checkip.dyndns.com 2->30 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 9 other signatures 2->50 9 New shipment  AWB NO - 09804480383.exe 2 2->9         started        signatures3 48 Tries to detect the country of the analysis system (by using the IP) 26->48 process4 signatures5 56 Binary is likely a compiled AutoIt script file 9->56 12 New shipment  AWB NO - 09804480383.exe 1 9->12         started        15 RegSvcs.exe 9->15         started        process6 signatures7 58 Binary is likely a compiled AutoIt script file 12->58 17 New shipment  AWB NO - 09804480383.exe 1 12->17         started        20 RegSvcs.exe 12->20         started        process8 signatures9 36 Binary is likely a compiled AutoIt script file 17->36 38 Writes to foreign memory regions 17->38 40 Maps a DLL or memory area into another process 17->40 22 RegSvcs.exe 15 2 17->22         started        process10 dnsIp11 32 checkip.dyndns.com 132.226.247.73, 49730, 49733, 49735 UTMEMUS United States 22->32 34 reallyfreegeoip.org 172.67.177.134, 443, 49731, 49732 CLOUDFLARENETUS United States 22->34 52 Tries to steal Mail credentials (via file / registry access) 22->52 54 Tries to harvest and steal browser information (history, passwords, etc) 22->54 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee/
Threat name:
Win32.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-11-25 00:26:36 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
24 of 38 (63.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5r7glfzwipcuiaysb5rki33vwegog4l4kt4yinpxmsle7habcxxa._file
Verdict:
malicious
Label(s):
unknown_loader_001
Create hunting rule
unknown_loader_036
Create hunting rule
autoit
Create hunting rule
Similar samples:
1de2fa3a2ecc25fc9b28f0e4ba4156a89d2b536c04bafc7b83014a6c5dc9dfaf
RedLineStealer
53a41d321309fbd29c4f6ae53618d02aae6d2f8b5707285d5be4f7f995e11485
RedLineStealer
6c6df909a12aa572bc7f7ba7a1274503a8f3860fec5223f08017e51f2d2fb9a5
RedLineStealer
89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83
RedLineStealer
df62b86792ee60f8c47bf085d989a882f04f3f208835beac365180c865c51129
RedLineStealer
dfca1291bcdc6fd3a0a7ae07cc153d3fc07c418138b1d2896f818d9ac3252a7c
RedLineStealer
ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee
RedLineStealer
error
RedLineStealer
+ 1'352 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection discovery keylogger stealer
Link:
https://tria.ge/reports/241125-cwvjfsyqdm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger payload
Snakekeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7399492470:AAF1Q52TLq6uEICFiCVrLu9dpROnjh2wukI/sendMessage?chat_id=1443320838
Verdict:
Suspicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/93badea9-a20a-40ce-9347-63741639463e
Unpacked files
SH256 hash:
37aca6c877f972310db6e22af35182a31d61e53d041e3f02051aa2cfd9114cf8
MD5 hash:
d72be887e1405510093785b3468ae23e
SHA1 hash:
6ab8fbaa5a5f9f0202b51b8dccca96a8e84285fa
Detections:
snake_keylogger
Create hunting rule
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
RedLine_Campaign_June2021
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Link:
https://www.unpac.me/results/7df91332-9633-4a46-9652-130800373c6c/
SH256 hash:
eb29bef513d359051cc052f2f43fcffa6e2cfd7c37fb0191ea8ae8f6f0f279c7
MD5 hash:
7083dd50c128b576a5c49254c03873fd
SHA1 hash:
52398bb96c78247d52129c1a7ba23ffa1c373603
Detections:
snake_keylogger
Create hunting rule
win_404keylogger_g1
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
MALWARE_Win_SnakeKeylogger
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Link:
https://www.unpac.me/results/7df91332-9633-4a46-9652-130800373c6c/
SH256 hash:
f1901ca44393323a9ee18e6d720c22976da373a585d07601b2e5719c5d9cb2b0
MD5 hash:
c8c239b97355dbfdfd77d376af9e1c17
SHA1 hash:
78a28e6e9c7e1f41d2fae35bcc82d50b058d4496
Detections:
win_samsam_auto
Create hunting rule
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MetaStealer_NET_Reactor_packer
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
SUSP_OBF_NET_Reactor_Native_Stub_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7df91332-9633-4a46-9652-130800373c6c/
SH256 hash:
ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee
MD5 hash:
c30f0328acefe083da339f7969a0fc3f
SHA1 hash:
c87d4ebc83d8efa8fa31e60f79e83205d436803c
Link:
https://www.unpac.me/results/7df91332-9633-4a46-9652-130800373c6c/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ec7e65973643/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

Executable exe ec7e65973643c54403120f62a46f75b10ce3717c54f98435f764964f9c0115ee

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments