MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7
SHA3-384 hash: db6cee863423dfd923642d9b92c5873aedcd1e4f43a28c242915d48c40837d95a11b051549ce1fb19dea4b6d523d94ca
SHA1 hash: 2a013d2c21b9157025653add9310ec44257e6499
MD5 hash: ca9aa4c6fde16d57e94b119cc399a668
humanhash: social-grey-cold-kitten
File name:5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'001'472 bytes
First seen:2022-06-24 14:33:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4d80ec2aa03cc8eee769158cd57096b5 (2 x RedLineStealer)
ssdeep 24576:WjwHZZUCG+dtji99M2tFch0H+YqpGvANVA4T:xZZUCG+bwOh0H+jVA4T
Threatray 6'272 similar samples on MalwareBazaar
TLSH T130257D3079C49576EDE310B783ECBD6542ADA0B00B264ACB8FD857FE96206C17F31696
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Finch39487976
Tags:exe MikuBot RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7.bin
Verdict:
No threats detected
Analysis date:
2022-06-24 15:35:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/57436bb6-d001-4b3c-bc22-5507d0fd8ab6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/283081/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/22733/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/62b5cb62e88d6da4ffc2ab83/reports/e7cb5d5d-6674-49fb-8679-682a2f67373b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d5261061-990e-4148-aadd-3cade0c88e81
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1019392
Signature
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-06-17 01:12:00 UTC
File Type:
PE (Exe)
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ll6pfl72nn75samhesynavd6x4yvdmaeylnk6svfcsovrg5u373q._file
Verdict:
malicious
Similar samples:
1894ee1e31d02ce95f3fb5bfaaeade0718232866702e70bd19a70a0a15a3343c
RedLineStealer
2b23d400c5e1977d69e510fd01c2f4fc5fcefddfae6e943e2fc0736e89af3a0e
RedLineStealer
68feb6c25b2ce057bdc2c97119f10b980a864b7c3306e785bbbff1ab8ca4197f
RedLineStealer
7dd608c140c1a44b0abcc1be8e24a710baabccb5f4d3b2c3f9b32a66134b275e
RedLineStealer
8d119118603a53029f45ad6d363a82ff66d1618dbed205a70ae96976e5eff6db
RedLineStealer
9e4b9c498fc20e6eb27a024773a5fd4ce9ef6c7c12e4ec03c00344afba69d2b5
RedLineStealer
+ 6'262 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7
MD5 hash:
ca9aa4c6fde16d57e94b119cc399a668
SHA1 hash:
2a013d2c21b9157025653add9310ec44257e6499
Link:
https://www.unpac.me/results/3ea10755-20d8-4fbb-a1ee-784678beae7e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5afcf2affa6b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5afcf2affa6b7fd9018724b0d0547ebf3151b004c2daaf4aa5149d589bb4dff7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/283081/

Comments