MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d
SHA3-384 hash:	a25395e23145ededd3b12bc6d4f77fb9193f684695ea64ef9316d84431aa94d86cf57b99b484e3976b0227068083939c
SHA1 hash:	63db01e3de84fa6019cd952868046e22a531c3f0
MD5 hash:	8c470c14fed50a3c4f3d686c5054dfe2
humanhash:	massachusetts-nine-blue-april
File name:	8C470C14FED50A3C4F3D686C5054DFE2.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	1'448'960 bytes
First seen:	2023-12-04 06:50:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a50f567b444f0fd10ba692c0c049b476 (1 x RedLineStealer)
ssdeep	24576:IPUoy0FnHglfwI5IEEf8eWqueqFMcRpvnf+pUI+6ROfv5Mbvf:IPUDIEfNacRpvnWpU56m5
TLSH	T1F965E65F63C2F487D08AE9B672079AF7B43127342B9E640363466D396E3035A91FD932
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	6cccd4e0f0d0c4d4 (8 x Loki, 3 x NanoCore, 2 x WhiteSnakeStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
167.235.132.231:39501

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

319

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/462237/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.6456.9034.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a window

Reading critical registry keys

Stealing user critical data

Dragonfly

Gathering data

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

lolbin mshtml overlay setupapi shell32

Link:

https://www.filescan.io/uploads/656d76d997dc047c4b97198b/reports/40008ab5-54d0-47c9-bc5e-48dbdba5acd1/overview

Hybrid Analysis Fugrafa.Generic

Verdict:

Malicious

Labled as:

Fugrafa.Generic

Link:

https://www.hybrid-analysis.com/sample/20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/3f95dfbe-09c6-4134-93e8-efbf46dbfbb6

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1352911

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-03 01:49:00 UTC

File Type:

PE (Exe)

Extracted files:

2

AV detection:

17 of 23 (73.91%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ecrxg4sf5up3gyj6kxe5aloamvo2zu62gzjp46sbxskajq3w6iwq._file

Threatray malicious

Verdict:

malicious

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/231204-hmgtwshe62/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

UnpacMe

Unpacked files

SH256 hash:

20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d

MD5 hash:

8c470c14fed50a3c4f3d686c5054dfe2

SHA1 hash:

63db01e3de84fa6019cd952868046e22a531c3f0

Link:

https://www.unpac.me/results/c983d895-3040-46c4-bf82-f9cbbc6cf67e/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.41

Link:

https://yomi.yoroi.company/submissions/20a3737245ed1fb3613e55c9d02dc0655dacd3da3652fe7a41bc9404c376f22d

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/462237/