MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb
SHA3-384 hash:	0003ef523bb755ae4438bfd52744dbbb5d203c0458771631b10858e8ea1eb50913b53cc51d78db7b79a6899484b11180
SHA1 hash:	c49760f02f87ae3b5ec6bf0ae217a4583f7ecc8b
MD5 hash:	03646964ec3cfb95b37ca1e940923579
humanhash:	west-zebra-high-neptune
File name:	03646964ec3cfb95b37ca1e940923579.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	681'472 bytes
First seen:	2020-06-15 15:44:46 UTC
Last seen:	2020-06-15 16:44:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c5e36fc44ee3ce5a368521435f9af78f (1 x ArkeiStealer, 1 x RedLineStealer)
ssdeep	12288:RpV9VIBSibAz4SirmW7DmXB/K8bZOK1mtDIP/0DT:R4vAE3rmaCXBygmzT
Threatray	78 similar samples on MalwareBazaar
TLSH	C6E4F142B680D071D567427208F9BE301E38FD265B61DB8B77987F2E29B81D16A33763
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/10520/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.DanaBot

Status:

Malicious

First seen:

2020-06-15 15:46:05 UTC

AV detection:

29 of 31 (93.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bxwot7nk7h6kqtkouzhzjz4j5yb2pj7gmpitqmt4mywe7qr2uk5q._file

Verdict:

malicious

RedLineStealer

2ba0f2e22ed07ca3188c898a0c9256fd30e878916ebe669ed52b25cb18d5ccde

RedLineStealer

34e142c3ca75844c48639cfc8f60513d23c02a65addef3bce69f5b49b34277a1

RedLineStealer

44ccaaf3cc76edd1e184d8c65b13db79638fcbf8ed37b5883c34a1a8a7700901

RedLineStealer

5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7

RedLineStealer

5ef8714caf9c7296847b67b27edb93c3aec23d7e77b57d23d0e8607d707a2c49

RedLineStealer

6c90f16a6932be921cbb44b9e4531cf36e5ded6d5dd0016c4309a56ab8a96461

RedLineStealer

8499aa17997bfbe03592e33e82df1c674f1b57ba3d372355e690b9468ea6fea2

RedLineStealer

b47f74419de5db79da95d6d39d6e7e0da43a2bb2dc5770a0ee3715bcb2d76299

RedLineStealer

ec837014dcb222fd3780d0730e297c9a09786cc57a42a9da092c9199c1f9660b

RedLineStealer

+ 68 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-z9saj8xtfa/

Behaviour

Checks processor information in registry

Modifies system certificate store

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Unknown_PWDumper_Apr18_3 Create hunting rule
Author:	Florian Roth
Description:	Detects sample from unknown sample set - IL origin
Reference:	Internal Research