MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19bb86a38eef963e7213c9a61590cce12ef9cfa814bddcc256dd158c93ad5e40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	19bb86a38eef963e7213c9a61590cce12ef9cfa814bddcc256dd158c93ad5e40
SHA3-384 hash:	04ec7f8a5704cec69a78fed7de2a544374608f213aec7a68dd36c528cc23ca0aa99da347aec1dd9b16a89177843a0a12
SHA1 hash:	173e17a9be68d593e47acb35863a2670cb50abe2
MD5 hash:	cf985009f46e2106daef2c393a6a7f31
humanhash:	foxtrot-oranges-april-delta
File name:	cf985009f46e2106daef2c393a6a7f31.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	623'616 bytes
First seen:	2021-09-07 14:32:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b96546bb8656e94382ad7dab68551d5e (3 x RaccoonStealer, 1 x CoinMiner, 1 x RedLineStealer)
ssdeep	12288:C+BuRVeYCCGZeJ8M4vVfByWuGLaWo3uISbjdGwbmZiRlGbyDsu0xQIOJx:ZOEZZNMjKnVaiRE+DWxQTx
Threatray	709 similar samples on MalwareBazaar
TLSH	T1D1D4F120B6D0C035F1B711F459B997ACA82E7DB25F2091CFA2C42BEE56356E49D3078B
dhash icon	e8e8e8e8aa62a489 (8 x RaccoonStealer, 6 x RedLineStealer, 2 x Tofsee)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

cf985009f46e2106daef2c393a6a7f31.exe

Verdict:

Malicious activity

Analysis date:

2021-09-07 14:36:00 UTC

Tags:

evasion opendir

Link:

https://app.any.run/tasks/38fe1811-7a79-4c87-865a-1045185a417c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLineDropperAHK

Link:

https://www.capesandbox.com/analysis/186069/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.10940.9425.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Connection attempt to an infection source

Sending an HTTP GET request to an infection source

Creating a file in the %AppData% subdirectories

Sending a UDP request

Query of malicious DNS domain

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ab08caad-3f25-4a9a-8ae4-44d679aad5b4

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spre.troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/846699

Signature

Antivirus detection for URL or domain

Creates HTML files with .exe extension (expired dropper behavior)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Yara detected Autohotkey Downloader Generic

Yara detected Evader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19bb86a38eef963e7213c9a61590cce12ef9cfa814bddcc256dd158c93ad5e40/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-09-07 14:02:19 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Verdict:

malicious

RedLineStealer

2aa76bdc54bdf4a5f8a4ce81a9bdd14e6789eb1cc1565d8cac67e101de4dae63

RedLineStealer

2d1dea49f82e34123861cf36ae63704941b7e2351e84efa2736a57158c333507

RedLineStealer

88efccdbd18a8f217304c67114fba6c25e329e9da1fedbae6e10974980946a2c

RedLineStealer

a2fae61ac7f611036cfa5c22aaf6e5264978a88cc15427481c6b1a25ff17372c

RedLineStealer

f1b072a4977439e50f66ceaa57528f53227d95fe762d0cd5250c45ed59e3ee9b

RedLineStealer

fe0257d13e355ae9db561731c4a3ba67dfdae4758527fdc5bcee05567f72d97e

RedLineStealer

+ 699 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

suricata

Link:

https://tria.ge/reports/210907-rwwtvagabl/

Behaviour

Checks processor information in registry

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

Unpacked files

SH256 hash:

5a056314ead75c8d10137bc23e09f64c8ad21ba621b8dade700ddf07decaf2de

MD5 hash:

4368f6919a0dc5bcd49e1769f6fdd512

SHA1 hash:

8c2ab9ff100159ac4c2ad8b790a0cc997e3b5905

Link:

https://www.unpac.me/results/a8713d46-b399-4ee6-87b4-996aa37e9470/

SH256 hash:

19bb86a38eef963e7213c9a61590cce12ef9cfa814bddcc256dd158c93ad5e40

MD5 hash:

cf985009f46e2106daef2c393a6a7f31

SHA1 hash:

173e17a9be68d593e47acb35863a2670cb50abe2

Link:

https://www.unpac.me/results/a8713d46-b399-4ee6-87b4-996aa37e9470/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/19bb86a38eef963e7213c9a61590cce12ef9cfa814bddcc256dd158c93ad5e40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Embedded_PE Create hunting rule

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers

Rule name:	MALWARE_Win_RedLineDropperAHK Create hunting rule
Author:	ditekSHen
Description:	Detects AutoIt/AutoHotKey executables dropping RedLine infostealer