MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee
SHA3-384 hash:	ab6317bade0f461336cc870f5a55e8344fc5e5f309eb7eb613fe53b517ac790dd8b3274fe0c957039ca37b0ce0c5b6af
SHA1 hash:	b5fa494f72e9b19faa4330389dee6f9811b8744d
MD5 hash:	b18433b1bfe6a9e4d608efded2de9b7f
humanhash:	nuts-quebec-avocado-fourteen
File name:	0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	638'976 bytes
First seen:	2021-07-31 04:24:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	613f2e4a97d34083c947d866c86b0b7d (4 x RedLineStealer, 2 x RaccoonStealer, 1 x ArkeiStealer)
ssdeep	12288:pSts2ACBiYB+ZHZpCdtL/91hMUyCKrlBUGabJA27l8IB0CcYqxtSRTGZaX:pj2ACBiYB+ZHedsUyhjUdb627lXBNQZm
Threatray	1'301 similar samples on MalwareBazaar
TLSH	T1E7D4F1306A90C035F4F722F45ABA9378A52D7AB06B3450CB63C51AEE07356E9EC31797
dhash icon	ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter	CholeVallabh
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

574

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee

Verdict:

Malicious activity

Analysis date:

2021-07-31 04:26:47 UTC

Tags:

evasion

Link:

https://app.any.run/tasks/2b17623d-0437-4ab5-b65b-fe568be16fab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/175403/

Detection(s):

Win.Packed.Generic-9882246-0

Win.Packed.Filerepmalware-9882257-0

Win.Malware.Generic-9882304-0

Win.Packed.Generic-9882417-0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/52d90b70-b4f2-4a92-9788-a0e2b735f95d

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spre.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/824812

Signature

Antivirus detection for URL or domain

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Yara detected Autohotkey Downloader Generic

Yara detected Evader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee/

Threat name:

Win32.Trojan.Caynamer

Status:

Malicious

First seen:

2021-07-28 19:45:02 UTC

AV detection:

16 of 28 (57.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bzccgjxck6fnbzxcf2rqzh6pmayxprjk63ngn3buoiowbzawnlxa._file

Verdict:

malicious

RedLineStealer

4319f1c762d767ad43a05956036dce2dc6588f8a356f35103ec80fdf7b19105c

RedLineStealer

4871df59eb4440514615fa7ef4a9f1bdfeb7e47a0d622ff354d89363cc3622d6

RedLineStealer

5a7ee4cb1dccb84bc40cd076d86a4b97e67776cd7b7ff6c2ed8816bd4046a4e5

RedLineStealer

9cefdffb73daf4a060fd9b44803eec6795db46ed96d49e1c6cb34e4224979321

RedLineStealer

b00dc3b0fb77b5893417308a832cfaabd7440230a1800807444af33f0475b005

RedLineStealer

b437017fcf0a4f6444183cbe1533b1f0901b83b501ac190adc787de4cc7f11a6

RedLineStealer

e9e058a97ae8281cf6435c759d712e14f91640aff79cc8a39dc605c46c042c60

RedLineStealer

+ 1'291 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/210731-rt3m5hvkqa/

Behaviour

Checks processor information in registry

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

Unpacked files

SH256 hash:

b3ba65424f7c39e87701dcac9047de407825528d09d236e66de2c25937ecf87d

MD5 hash:

9376b7133674bfb3e0350df0ad90eb76

SHA1 hash:

e191eef5acfeb42bd8431ad7ff7ecc9bedc6c250

Link:

https://www.unpac.me/results/16a2a36c-25bd-49e2-ae2b-226e35c14993/

SH256 hash:

0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee

MD5 hash:

b18433b1bfe6a9e4d608efded2de9b7f

SHA1 hash:

b5fa494f72e9b19faa4330389dee6f9811b8744d

Link:

https://www.unpac.me/results/16a2a36c-25bd-49e2-ae2b-226e35c14993/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0e442326e2578ad0e6e22ea30c9fcf603177c52af6da66ec34721d60e4166aee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MALWARE_Win_RedLineDropperAHK Create hunting rule
Author:	ditekSHen
Description:	Detects AutoIt/AutoHotKey executables dropping RedLine infostealer