MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49ac79947d9ce11b0df34c8d18ea68d78e240dcd3d6cf8176fe10010493a5d3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49ac79947d9ce11b0df34c8d18ea68d78e240dcd3d6cf8176fe10010493a5d3a
SHA3-384 hash: 040e50e3f4358dc279575399b91f5cb3c3549e61fad5adc0f33abc7f287780ba65cb10e7dbdc575ff3acd7cd88a7104b
SHA1 hash: 551506a347250d487f56c8f48ebdab65407c2d83
MD5 hash: 031e017bfcfb6f3a41138b53ca06a215
humanhash: beer-king-steak-mike
File name:031e017bfcfb6f3a41138b53ca06a215
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:2'306'048 bytes
First seen:2023-03-31 15:50:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 49152:Nu0HYKaYysNLxZFNxvyw30i7YTBxxFTPDAVy4G8tk:YWYwPN9ZDv0i7U7TPDJ
Threatray 258 similar samples on MalwareBazaar
TLSH T15DB53385F6F480B2D874AF3121F613D30239BE72896E9B8B3A81644A1F735D1D535BB1
TrID 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:031e017bfcfb6f3a41138b53ca06a215 exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
031e017bfcfb6f3a41138b53ca06a215
Verdict:
Malicious activity
Analysis date:
2023-03-31 15:53:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dccdc5f5-808d-49ab-852a-c7d3d9ed3766

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/379073/
Detection(s):
Sanesecurity.Malware.29170.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Сreating synchronization primitives
DNS request
Sending a UDP request
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/75896/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Labled as:
Packed.CAB
Link:
https://www.hybrid-analysis.com/sample/49ac79947d9ce11b0df34c8d18ea68d78e240dcd3d6cf8176fe10010493a5d3a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e4d9b25c-77bd-4b83-a161-b8e1b1757cfb
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1205984
Signature
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 838900 Sample: 7FNHWBXa4M.exe Startdate: 31/03/2023 Architecture: WINDOWS Score: 56 24 Multi AV Scanner detection for submitted file 2->24 7 7FNHWBXa4M.exe 1 8 2->7         started        10 rundll32.exe 2->10         started        process3 file4 20 C:\Users\user\AppData\Local\...\ednxcivp.dat, PE32+ 7->20 dropped 12 cmd.exe 2 7->12         started        process5 file6 22 C:\Users\user\AppData\Local\...\conhost.exe, PE32 12->22 dropped 15 conhost.exe 1 12->15         started        18 conhost.exe 12->18         started        process7 signatures8 26 Found evasive API chain (may stop execution after checking system information) 15->26 28 Found API chain indicative of debugger detection 15->28
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49ac79947d9ce11b0df34c8d18ea68d78e240dcd3d6cf8176fe10010493a5d3a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgwhtfd5ttqrwdptjsgrr2ti26hcidonhvwpqf3p4eabasj2lu5a._file
Verdict:
suspicious
Similar samples:
155c76210badfc3ef9bfc764a7ab3cb9702f76c9d63351a213f61d44abbf0b4f
RedLineStealer
18055486aef1f706a69134be283fffdad9c49f5ffecda5d869e74c2ae882cd6c
RedLineStealer
242467ea19694c0e6cd76dcff901f5af6a309c2c999971b1dc4cd9bad253ea19
RedLineStealer
38eab87af431cba1bbec5ca10fa9502a0b110c1baf6372f5c271584b02eb2857
RedLineStealer
4b4eb8ac2362a026112033f822d2b84d5da55e18c922790d8dd2a905fdaad8cb
RedLineStealer
5920894ae997b61f27b53c9f6e598df5f928acb11a5dc09f4fa0627747f1312d
RedLineStealer
8b3915b52f03e8a23c59146ceb7f9d50b0a59e466c2c4e1f3ac3e7875106350e
RedLineStealer
ae54c18727715192eb0e5160f7ef9f7ff2382a517679a6c84e1136280ed11aee
RedLineStealer
+ 248 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230331-tag5nscf5w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
9abf82ffa8e18fa56595618f3d561a2014ff5fa95a9e978f68cbf45847e7c18f
MD5 hash:
3d4802475d93713ffe62fc2c28085a09
SHA1 hash:
0c6dd0939d2ca4d3ceb09f73c31fbc874646a7c0
Link:
https://www.unpac.me/results/91fd9e43-c468-47af-bd74-83ba77abd54c/
SH256 hash:
49ac79947d9ce11b0df34c8d18ea68d78e240dcd3d6cf8176fe10010493a5d3a
MD5 hash:
031e017bfcfb6f3a41138b53ca06a215
SHA1 hash:
551506a347250d487f56c8f48ebdab65407c2d83
Link:
https://www.unpac.me/results/91fd9e43-c468-47af-bd74-83ba77abd54c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/49ac79947d9c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/49ac79947d9ce11b0df34c8d18ea68d78e240dcd3d6cf8176fe10010493a5d3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/379073/

Comments