MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 18


Intelligence 18 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3
SHA3-384 hash: 4620c2480230bb8013b20c525b60ec72703eff701a1d85edfa40ff3ebc1c179688569dce5c917ee0fc05c72feca2a2c1
SHA1 hash: 3eea434063b29bd161c875d4ab22ac9983c7bf6e
MD5 hash: 661c72c6ea35739a807366da34d0052f
humanhash: august-river-pasta-east
File name:Fiyat Teklif_Erymetal A.s_MKLoO8887.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:993'792 bytes
First seen:2023-09-21 13:52:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf5a4aa99e5b160f8521cadd6bfe73b8 (434 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep 12288:Hh1Lk70TnvjcXn4GJmWvNgczUjmYYSHIFHpCLE+8MbElL3JWl8CnpOOXA:Tk70TrcX4zWvNPURNIFIEWbqYpO
TLSH T1C225BEE031BDC3A3D1B14EB10FCA867079F1316C98D4564EB1F99B2EA7D239110AD5EA
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d4a6a494a48484a4 (65 x AgentTesla, 39 x Formbook, 8 x RemcosRAT)
Reporter abuse_ch
Tags:exe geo RedLineStealer TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
formbook
Create hunting rule
ID:
1
File name:
Fiyat Teklif_Erymetal A.s_MKLoO8887.exe
Verdict:
Malicious activity
Analysis date:
2023-09-21 14:04:24 UTC
Tags:
formbook xloader trojan stealer spyware
Link:
https://app.any.run/tasks/222a073c-9c6c-4ba1-9334-713b7a55da7b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/450392/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.InjectNET.50.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Sending a custom TCP request
Reading critical registry keys
Launching cmd.exe command interpreter
Creating a file in the %temp% directory
Searching for synchronization primitives
Creating a window
Unauthorized injection to a recently created process
DNS request
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin net_reactor packed packed
Link:
https://www.filescan.io/uploads/650c4ac083a0c6425dfb8598/reports/fc12dc47-5c0e-4dae-8a87-3f7f7685dbdf/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5afd2ed2-35da-439f-b946-7031458b0b26
Result
Threat name:
FormBook, RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1312331
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected FormBook malware
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Steal Google chrome login data
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected FormBook
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1312331 Sample: Fiyat_Teklif_Erymetal_A.s_M... Startdate: 21/09/2023 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 11 other signatures 2->49 10 Fiyat_Teklif_Erymetal_A.s_MKLoO8887.exe 1 2->10         started        process3 signatures4 61 Writes to foreign memory regions 10->61 63 Allocates memory in foreign processes 10->63 65 Injects a PE file into a foreign processes 10->65 13 aspnet_compiler.exe 10->13         started        16 aspnet_compiler.exe 10->16         started        18 aspnet_compiler.exe 10->18         started        process5 signatures6 69 Modifies the context of a thread in another process (thread injection) 13->69 71 Maps a DLL or memory area into another process 13->71 73 Sample uses process hollowing technique 13->73 75 Queues an APC in another process (thread injection) 13->75 20 explorer.exe 10 12 13->20 injected 77 Tries to detect virtualization through RDTSC time measurements 16->77 process7 dnsIp8 37 www.imtmatcher.shop 213.171.195.105, 49808, 49809, 49810 ONEANDONE-ASBrauerstrasse48DE United Kingdom 20->37 39 www.dm4im2q2.top 38.177.170.145, 49792, 49793, 49794 COGENT-174US United States 20->39 41 14 other IPs or domains 20->41 51 System process connects to network (likely due to code injection or exploit) 20->51 24 msdt.exe 19 20->24         started        signatures9 process10 file11 33 C:\Users\user\AppData\...\961logrv.ini, data 24->33 dropped 35 C:\Users\user\AppData\...\961logri.ini, data 24->35 dropped 53 Detected FormBook malware 24->53 55 Tries to steal Mail credentials (via file / registry access) 24->55 57 Tries to harvest and steal browser information (history, passwords, etc) 24->57 59 3 other signatures 24->59 28 cmd.exe 2 24->28         started        signatures12 process13 signatures14 67 Tries to harvest and steal browser information (history, passwords, etc) 28->67 31 conhost.exe 28->31         started        process15
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-09-21 13:53:06 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5u443m4pkryay3hto5umvplygz5a32ktvmpgjmp5r2nwidur3dzq._file
Verdict:
malicious
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:bz24 rat spyware stealer trojan
Link:
https://tria.ge/reports/230921-q6ywhsgd6s/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Formbook payload
Formbook
Unpacked files
SH256 hash:
463aa045f854ffecb3946a07f05997a71824403dc0c12a04b751c651cb917e5b
MD5 hash:
322f33b7c58a749e10d8702e7bc43282
SHA1 hash:
8b5a29c485af013acd1e003f27726604d52a9612
Detections:
FormBook
Create hunting rule
win_formbook_w0
Create hunting rule
win_formbook_auto
Create hunting rule
win_formbook_g0
Create hunting rule
Link:
https://www.unpac.me/results/fad65ff5-b181-4ef1-b7eb-b59877ba1587/
Parent samples :
ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3
fd50d6b7509b787326363d683eea439e2aa01086b726a95d3fe9987366275bfb
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f
SH256 hash:
9f95ca27e874d387286b35acbc8233b9877dc67d9584e73f3967d7922edf885b
MD5 hash:
4fe26bda03cded2267a25317e3de8aff
SHA1 hash:
62e74bb688aa387af21bf66f91c4fbc853631556
Link:
https://www.unpac.me/results/fad65ff5-b181-4ef1-b7eb-b59877ba1587/
SH256 hash:
30d412e6e9a82b280aa79d160618acb9df257c86765819f0861ad24316cfe6c6
MD5 hash:
bc8a2ee9c89b04728d87bec4510ff1a7
SHA1 hash:
61ad8cccf09eddffa46fe4aeeac12062da0d6626
Link:
https://www.unpac.me/results/fad65ff5-b181-4ef1-b7eb-b59877ba1587/
SH256 hash:
1ca221439953c63ff9df93b2d9392fbd9e41d5b9674b90eabc68c6ceceb3943e
MD5 hash:
59979ff746e75b3423aeccdf5aa92ffc
SHA1 hash:
25b7b5ae2953808f92ebd9585cb183d6800e5115
Link:
https://www.unpac.me/results/fad65ff5-b181-4ef1-b7eb-b59877ba1587/
SH256 hash:
ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3
MD5 hash:
661c72c6ea35739a807366da34d0052f
SHA1 hash:
3eea434063b29bd161c875d4ab22ac9983c7bf6e
Link:
https://www.unpac.me/results/fad65ff5-b181-4ef1-b7eb-b59877ba1587/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ed39cdb38f54/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RedLineStealer

Executable exe ed39cdb38f54700c6cf37768cabd78367a0de953ab1e64b1fd8e9b640e91d8f3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/450392/

Comments