MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 17

Intelligence 17 IOCs YARA 3 File information Comments

SHA256 hash:	ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137
SHA3-384 hash:	53d32176f87d7462c1ce424ef8b8bd9ac8ffcbbd9b0b1dcef786bcce0b1debe6f9321acb4f12373f6786e856b7d58053
SHA1 hash:	dc90ec29c5da5414702e9163ae0133d207608960
MD5 hash:	b0cfe4185035fc751ed0a62b1a95af98
humanhash:	rugby-thirteen-leopard-item
File name:	setup.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	514'560 bytes
First seen:	2024-07-01 22:15:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bdd081110ce6691ddde6cfe79c51d26e (2 x RedLineStealer)
ssdeep	12288:R9Z5uG0VGH6CNq93+xYg1dSjBYSuBbT+g6:vlOGaCT7ZBBbq
TLSH	T14CB4F11574C08072D662113206F4D7B89E3DF9304F669ECF67D80B7E4F742D29936AAA
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	Chainskilabs
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

370

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137.exe

Verdict:

Malicious activity

Analysis date:

2024-07-02 05:57:17 UTC

Tags:

stealer redline metastealer

Link:

https://app.any.run/tasks/12df7b2a-a7f6-4ea3-a0c1-ec304b8ee2e5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Keylogger.Lazy-10031941-0

Win.Packed.Zusy-10032583-0

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66832ab9251d4687fe42c86ewin10vpnfull_triage

Tags:

Redlinesteal

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Creating a window

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Сreating synchronization primitives

Creating a file

Stealing user critical data

Unauthorized injection to a system process

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

epmicrosoft_visual_cc fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/66832aa5910ce98966fb644a/reports/95fce4ce-7b61-4fd7-9260-b6f03d5095c5/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLine Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e3558103-9020-4a44-80be-f1d2f5a95f3f

Result

Threat name:

RedLine

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1465692

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2024-07-01 03:15:35 UTC

File Type:

PE (Exe)

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=55ossucqum6ltqv5a2njbbk4otpvruhx6yryrbnurjscf23nue3q._file

Verdict:

malicious

Result

Malware family:

redline

Score:

10/10

Tags:

family:redline botnet:logsdiller cloud (tg: @logsdillabot) discovery infostealer spyware stealer

Link:

https://tria.ge/reports/240701-16r33sxaql/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

Malware Config

C2 Extraction:

77.105.135.107:3445

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/45003196-8ad9-415d-bfca-fc0eb8802ec1

Unpacked files

SH256 hash:

f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9

MD5 hash:

65f8fcab7cfe7aecbdd653d2ec0837ed

SHA1 hash:

ea9596a2624d5790c2bc4df8a68cfa0f058e6b29

Detections:

redline

Link:

https://www.unpac.me/results/e6e1327f-8974-42f9-af83-a635b4c26b6a/

Parent samples :

ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137
cf47a943ec0eb86c16a8d7e6e0ad8c4bfb6063af089e1b3809ed44ac45347e71
c4024302b2f74461f6aecd5ca2f2889fa8ed48a420cb2176ae782368e2c5c6eb
fe8b79e2efd9685857c859a5449501fdac4cb227b478beaa6c6f765d12589f0b
7cf88e667498e50034c25767aaf38bca971a5c995f61fe686b44f7bcc0f71851
11bff9eb960203dd7142e9673fe524c7e1e4d4982a80ea2000b59cd4ee335ee8
b6bc0277793660688621a374f2c09c7cd3801ab09e849568627295618a33ebde
04028809b505f00031b6f0135ca5ee100d29180b53151b3b5a6acaa4e4e9e445
15d42ae4cb79d31477b5b65884a5fe2cd73a6dc05ff384c00c6d8dc0d93af189
888452aed556bafda19c8899eedb37b71533f7ad316f03c2c4d5f5b1956d45f4
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9
96b5ad76adbcdbd8794fc6ba8209ffdda1815304eda98e5b6d12d2aee2ff0051
73f00d2746a71e412b9c6d43c7f5e0ed5faf3e03730bfd6e24b8955e42c2267e
7010eb737bc8cbc8598ae5de392f485406f7fd1e821f0d7e6649f3022fcf8ac8
f408c8ba5781966f6ce1da805de79deb4a5e3c9dfbe097493123257e6112bf71
b190b4f3105af4a2a02db28f27d1c723c09ba419ef73a89b555078c5041a2486
96db11589e31f55a3bb06de8f13246d3220a483e5ff41f8fabbb1070e0bf52fa
93058e43cdbdae3b4cd091a75e0e5c11e944dd7e2ca76f3ad09c7470e8162503
86cc1b1b3f36ddee258f2bae60a7a77a0dded47b080f7911eb5b7013912f7ace

SH256 hash:

ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137

MD5 hash:

b0cfe4185035fc751ed0a62b1a95af98

SHA1 hash:

dc90ec29c5da5414702e9163ae0133d207608960

Link:

https://www.unpac.me/results/e6e1327f-8974-42f9-af83-a635b4c26b6a/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ef5d295050a3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleWindow KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample