MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
SHA3-384 hash: 430dc924054f389dfae968712e138ddec09c0d926cb9aa1a8fa6044b3495b041a66194654d63e44e34a20575c118314e
SHA1 hash: e6c3ab7b6da65c8cc7dd95351f118caf3a50248d
MD5 hash: 3d10b67208452d7a91d7bd7066067676
humanhash: burger-november-papa-oscar
File name:99612714.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:179'712 bytes
First seen:2023-05-13 22:45:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf5a4aa99e5b160f8521cadd6bfe73b8 (434 x RedLineStealer, 31 x AgentTesla, 12 x DCRat)
ssdeep 3072:dDKW1LgppLRHMY0TBfJvjcTp5XVuRkOICjBHQDpfOGY:dDKW1Lgbdl0TBBvjc/VuROCjBHQDM
Threatray 1 similar samples on MalwareBazaar
TLSH T129049D2135D1C1B3C4B7113044EACB759A3A7072077A96D7B79D2BBA6E213D1A3362CE
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter JaffaCakes118
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
86d4d9a88121e238a5c4d9257fec94bf.exe
Verdict:
Malicious activity
Analysis date:
2023-04-26 14:52:47 UTC
Tags:
trojan amadey raccoon recordbreaker rat redline loader stealer
Link:
https://app.any.run/tasks/f8fe9dde-2feb-46cf-b94a-c6807597f65c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/388983/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541.UNOFFICIAL
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.RedLine-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a service
Sending a custom TCP request
Creating a file
Blocking the Windows Defender launch
Disabling the operating system update service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed zusy
Link:
https://www.filescan.io/uploads/64601335531a5c5018010108/reports/b16242bf-7a60-4706-86fc-8e9924282ec7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d364efdf-c7df-4071-a0cc-12fdfe770db2
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1232627
Signature
Antivirus / Scanner detection for submitted sample
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302/
Threat name:
Win32.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-04-26 13:05:11 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
25 of 37 (67.57%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsfoszzzxwkfjjm6sk26w2lfmrydb2dukp34if6327kt5pmdomba._file
Verdict:
malicious
Similar samples:
f149490391d3bfc179573bd69e2d8087bb29c1c1095a24d515a1b432f36a7ddc
RedLineStealer
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/230513-2pzl9she95/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Windows security modification
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
8b877bdfb0c91f76cc1192d779613898bd29df9a00be255b63b6835e7e01a0ed
MD5 hash:
f76870e9b377c47dfe8711436c6e504b
SHA1 hash:
3589e629ee11b0b241c75cd3756cbf17b9933327
Detections:
HealerAVKiller
Create hunting rule
Link:
https://www.unpac.me/results/e97d91df-3633-4eca-8cee-1231adcdb27b/
Parent samples :
f149490391d3bfc179573bd69e2d8087bb29c1c1095a24d515a1b432f36a7ddc
5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
SH256 hash:
69b5c34b69afc34f2ac104a5819c49fca8fb0b1826629ea41e5bb062f6f7d4e7
MD5 hash:
a078528612df3cb622d321e84e11f196
SHA1 hash:
0b0e992de884e16fe5c3da9bc84395cd5b62ad6b
Detections:
HealerAVKiller
Create hunting rule
Link:
https://www.unpac.me/results/e97d91df-3633-4eca-8cee-1231adcdb27b/
Parent samples :
f149490391d3bfc179573bd69e2d8087bb29c1c1095a24d515a1b432f36a7ddc
5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
SH256 hash:
5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302
MD5 hash:
3d10b67208452d7a91d7bd7066067676
SHA1 hash:
e6c3ab7b6da65c8cc7dd95351f118caf3a50248d
Link:
https://www.unpac.me/results/e97d91df-3633-4eca-8cee-1231adcdb27b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/388983/

Comments