MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17ec626960cc18f96be98ce637dccadd511388c8399ca92a86f928f1cb314bae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	17ec626960cc18f96be98ce637dccadd511388c8399ca92a86f928f1cb314bae
SHA3-384 hash:	3c556d377ba128ccb541e60af30281a1498e6dad4ef36889997c0ea617024c755e63e128530a40082e0e6cf6c1ea67bb
SHA1 hash:	4a41bfafe66830168abccc9580cc6eeeefb2af55
MD5 hash:	ff2e018b080dce69282bb1d040b0917e
humanhash:	rugby-berlin-ceiling-river
File name:	ff2e018b080dce69282bb1d040b0917e.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	714'752 bytes
First seen:	2021-06-21 08:59:14 UTC
Last seen:	2021-06-21 09:42:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	621d175e940c3f2ca7217a398b3c22a6 (11 x RedLineStealer, 2 x DarkVNC, 1 x ArkeiStealer)
ssdeep	12288:UCFUDxyHjtba+v22j7XIJYIZkEtYeHYoF0oqbDq3xy74CFHalZ:URDxyHj99XOXkEt9YFoQqs+
Threatray	413 similar samples on MalwareBazaar
TLSH	7DE4E110BA92C035F6F791F845BA9368653E7EE1AB2860CF12D516DE1A747E1EC32313
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ff2e018b080dce69282bb1d040b0917e.exe

Verdict:

Malicious activity

Analysis date:

2021-06-21 09:02:44 UTC

Tags:

evasion trojan

Link:

https://app.any.run/tasks/41e8c27f-b79f-4b2a-82d9-264324ebfbd6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLineDropperAHK

Link:

https://www.capesandbox.com/analysis/167240/

Detection(s):

SecuriteInfo.com.Troj.Kryptik-TR.25307.7469.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2cd99f9f-dac7-4892-988a-110bdb56904d

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/805214

Signature

Contains functionality to register a low level keyboard hook

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Evader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/17ec626960cc18f96be98ce637dccadd511388c8399ca92a86f928f1cb314bae/

Threat name:

Win32.Trojan.RedLineStealer

Status:

Malicious

First seen:

2021-06-21 09:00:17 UTC

AV detection:

21 of 46 (45.65%)

Threat level:

5/5

Verdict:

unknown

RedLineStealer

57016c84e1c008db532f1c977fe608a767cdfc4a19f8619cbfdd82fe82a2aeae

RedLineStealer

679edb212554b93cab86d093150f288010f0b0a71d813f23461ddc1bb8151b13

RedLineStealer

6bdc604eae27b29cb103a130734a0bbef2d7f36d53d5a5f1b9458935e49b6326

RedLineStealer

6c1b17e5d8fb103a8a0fffa08a6f25ef2ec3cc414491159b00342c6dea9ca47f

RedLineStealer

7341c40c1693ae8350ec3eb83cce1d9e0744340b3dde2241e146b410f54c191b

RedLineStealer

90823e9bf099b873263241a2a7c3435b85fe6480ecb4fff4da9563ba95e7b31e

RedLineStealer

ebed275eba9f8eddb2242c93732b7a213ede149bd79a792de9d6f8dda6d7f3a3

RedLineStealer

ed3f452a9fed41f5d3dfb528d6c05a53298b559775eeec46eda50ad42a714b28

RedLineStealer

f84d6070c612dcd27962e45d37cebe1a2f4065c8d8187987e357208b2367dd15

RedLineStealer

+ 403 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/210621-geyeez33hj/

Behaviour

Checks processor information in registry

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

Unpacked files

SH256 hash:

d871e285d3833a7b44679a4a26137275e42333037da8cd891121f5dfc06c0caa

MD5 hash:

8b82a23501981d6a599e4c44acfe6d41

SHA1 hash:

407959a0486a11cbda5d85e1bd307f816d8ae5f4

Link:

https://www.unpac.me/results/0482a616-d044-46c2-8fd4-a6be7c18f77a/

SH256 hash:

17ec626960cc18f96be98ce637dccadd511388c8399ca92a86f928f1cb314bae

MD5 hash:

ff2e018b080dce69282bb1d040b0917e

SHA1 hash:

4a41bfafe66830168abccc9580cc6eeeefb2af55

Link:

https://www.unpac.me/results/0482a616-d044-46c2-8fd4-a6be7c18f77a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/17ec626960cc18f96be98ce637dccadd511388c8399ca92a86f928f1cb314bae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers

Rule name:	MALWARE_Win_RedLineDropperAHK Create hunting rule
Author:	ditekSHen
Description:	Detects AutoIt/AutoHotKey executables dropping RedLine infostealer