MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 14
| SHA256 hash: | 57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355 |
|---|---|
| SHA3-384 hash: | 4eef0a33baa1b105aa151d4714e2562ff079207d63b12cc901179183b6ca37d5f991562dc88303db74e7dc1f4f5f1f2a |
| SHA1 hash: | 47d357a4e617b46e47ddc8aa9869f33a3c9fffb8 |
| MD5 hash: | fde4ec171a6e988c9640d8f8dcf35aea |
| humanhash: | asparagus-west-ack-whiskey |
| File name: | 57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 7'864'260 bytes |
| First seen: | 2023-07-16 02:50:50 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 846876fcfaab8d0675698c01a809ad4d (1 x Amadey, 1 x CoinMiner, 1 x RedLineStealer) |
| ssdeep | 98304:9bRwXuv0bjY0mqBvzKczYA3IycQ6XpyWzI/vjhugtsoQYWb7lFGo:MeMVvaAPHzhug4pU |
| TLSH | T1508612AF614433ADC01BC87C5433FC8AB1B15E1FE6E9859AB5DBB7803BFA0509586B05 |
| TrID | 44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3) |
| File icon (PE): |  |
| dhash icon | f474d4ccccf471b0 (1 x RedLineStealer) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
299
Origin country :
NLVendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
57962D6E4DEA092778CA4B98D68EE62D11A8CFA88FD7F.exe
Verdict:
Malicious activity
Analysis date:
2023-07-16 02:53:20 UTC
Tags:
evasion privateloader opendir loader payload fabookie stealer rat redline gcleaner botnet smoke trojan miner tofsee arkei vidar ransomware stop amadey
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Modifying a system file
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Replacing files
Sending an HTTP GET request
Launching a service
Launching a process
Reading critical registry keys
Creating a file
Sending a UDP request
Forced system process termination
Blocking the Windows Defender launch
Adding exclusions to Windows Defender
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
control greyware lolbin overlay packed shell32
Verdict:
Malicious
Labled as:
Tedy.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Result
Threat name:
Amadey, Fabookie, Nymaim, PrivateLoader,
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Drops PE files to the document folder of the user
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Modifies Group Policy settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
PE file has a writeable .text section
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Amadeys stealer DLL
Yara detected Fabookie
Yara detected Nymaim
Yara detected PrivateLoader
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Gathering data
Threat name:
Win64.Trojan.Scar
Status:
Malicious
First seen:
2023-07-11 23:19:00 UTC
File Type:
PE+ (Exe)
Extracted files:
10
AV detection:
18 of 38 (47.37%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Result
Malware family:
privateloader
Score:
10/10
Tags:
family:privateloader loader spyware stealer
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Drops file in System32 directory
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
PrivateLoader
Unpacked files
SH256 hash:
57962d6e4dea092778ca4b98d68ee62d11a8cfa88fd7fd7b89cb97fba2193355
MD5 hash:
fde4ec171a6e988c9640d8f8dcf35aea
SHA1 hash:
47d357a4e617b46e47ddc8aa9869f33a3c9fffb8
Malware family:
Amadey
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.