MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 646b832c7b5c5245cfeece67567c8a6181e44595e54fc8e28ce6aa5b7350ea46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 12
| SHA256 hash: | 646b832c7b5c5245cfeece67567c8a6181e44595e54fc8e28ce6aa5b7350ea46 |
|---|---|
| SHA3-384 hash: | 21b8bda96d12a9e417fa83babd92407ab8c86c9df4812e267bf687a016ea0cd737c38886baa1d1ec9c57edb3ad6c747a |
| SHA1 hash: | 0f0c1aa695796b6e1ec328726d8c4b722d7d77e3 |
| MD5 hash: | 72a54447de39257bb10e7117d2209b08 |
| humanhash: | mockingbird-floor-double-berlin |
| File name: | hotel_video_confirmation.mp4.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 13'668'104 bytes |
| First seen: | 2023-11-13 05:38:32 UTC |
| Last seen: | 2023-11-13 07:29:44 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 393216:zz13/19ICVjz44qxB9JnLDXeKbfWRYxKjIGG:zt/ICFC5LDMKYkGG |
| Threatray | 948 similar samples on MalwareBazaar |
| TLSH | T140D6E02CF69DFDD1F53C82B5D9E1C4E8A071686702D1EA7368F4984E1B112AC85CEF4A |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | 74e0dcdcdcccccd4 (4 x RedLineStealer, 2 x Quakbot) |
| Reporter |  JAMESWT_WT |
| Tags: | bookinggoogledrive exe mega RedLineStealer |
Intelligence
File Origin
# of uploads :
2
# of downloads :
346
Origin country :
ITVendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
masquerade overlay packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Malware family:
RedLine Stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Score:
98%
Verdict:
Malware
File Type:
PE
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 938 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline infostealer
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
RedLine
RedLine payload
Unpacked files
SH256 hash:
640880c7064a07f32fce3a96e17751eb30a1fd0d83dc1f074323d9d9c9374917
MD5 hash:
4beed2e9a38cd201cc20fbe9c5b2d05a
SHA1 hash:
e00759c6699317a8812fe69648bda3451a2a687c
SH256 hash:
137958f4a2317dca637b5298773594ece0dce793fd39ed9993eb2b7add6d311a
MD5 hash:
ae06c18ae45fc3470ac104a2c37ae22d
SHA1 hash:
7c3be80477352755d52ce63c552269c34293ac9a
SH256 hash:
b643417f916c818e94238efabd5ca7226ff7970ab5c7732ed568c104aee343df
MD5 hash:
0869b29d9328adf97b0ffcb23c2a9458
SHA1 hash:
7ba2ff21d5c0071ab5cd6fcbf5c56862e3931a5a
SH256 hash:
fc1b6ea2a378100d9b7baef74f5c9e4fcfdbc23c32b0519e0fecd3fe95476b07
MD5 hash:
2ae7368346432e10490dd9d6187b7063
SHA1 hash:
2e5781b23596cdcafcecee0875693fad54003480
SH256 hash:
39c95b4d3a0b0992aa6c826412769cdc7ccad0fb8b470a84e9b515c1afe0ec8d
MD5 hash:
43d59b5767b8ef86e11f1c6646ba594a
SHA1 hash:
0f23fd8388fdaf4e5a058332c153201eae4f3475
Detections:
redline
SH256 hash:
646b832c7b5c5245cfeece67567c8a6181e44595e54fc8e28ce6aa5b7350ea46
MD5 hash:
72a54447de39257bb10e7117d2209b08
SHA1 hash:
0f0c1aa695796b6e1ec328726d8c4b722d7d77e3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.