MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 658649933d0c88c7252be289027158b60cefffb9c6102bb6f963c68d9ddf8191. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 658649933d0c88c7252be289027158b60cefffb9c6102bb6f963c68d9ddf8191
SHA3-384 hash: 26a2ae7f041767456df685442f9a4a93af8fb7132b4b69ff64a33dd05adac0466102090846a515497d6a9f28c186c26a
SHA1 hash: 524982b9d64f784080046c38ae710a636cc441d3
MD5 hash: a9f078fc88338d20af4bbd2018a8a2d8
humanhash: five-wisconsin-video-march
File name:a9f078fc88338d20af4bbd2018a8a2d8
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:707'072 bytes
First seen:2021-10-09 16:06:46 UTC
Last seen:2021-10-09 18:54:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 88f6b4d5fe41c261e2640642cf08fe8a (2 x RedLineStealer, 1 x DanaBot)
ssdeep 12288:UEFIE0ZNLvyawFsA5yHkNtOXagKZTJtMGv0vnohVBReoinVf8sGVhW/2GKE:xMLKawF5EHkNSaFd7MGvRTBsoin6sUWx
TLSH T178E4E110B3A0C035F5B226F889F99268E62E7EB16F6580CF52C516EE4B756E0ED30357
File icon (PE):PE icon
dhash icon 9824e7d0c4e7215c (11 x RedLineStealer, 5 x Smoke Loader, 2 x RaccoonStealer)
Reporter zbetcheckin
Tags:32 exe RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a9f078fc88338d20af4bbd2018a8a2d8
Verdict:
Malicious activity
Analysis date:
2021-10-09 16:09:23 UTC
Tags:
evasion opendir
Link:
https://app.any.run/tasks/9022d7ee-811c-49f4-beda-169c71c55619

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLineDropperAHK
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196328/
Detection(s):
SecuriteInfo.com.Ransom.Stop.Z5.13519.5673.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Launching a process
Creating a file in the Windows subdirectories
Deleting a recently created file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6161be2a334ba92bd923412a/reports/0f230726-28c4-4b8d-a111-6874965b90ed/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/658649933d0c88c7252be289027158b60cefffb9c6102bb6f963c68d9ddf8191/
Threat name:
Win32.Ransomware.LockbitCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-09 16:07:07 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwdetez5bsemojjl4keqe4kywygo775zyyicxnxzmpdi3ho7qgiq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/211009-tkmsxafce3/
Behaviour
Checks processor information in registry
Enumerates physical storage devices
Legitimate hosting services abused for malware hosting/C2
Unpacked files
SH256 hash:
3e03276ca78e28e6fefd198149bcdb01cf7a270aed3cb9179ad872432fc75e30
MD5 hash:
cca9b5c4b9215b0af98d38a033c1f1f7
SHA1 hash:
434312d50110aff25091952a9c482e4d2212a908
Link:
https://www.unpac.me/results/a66b4ed0-f335-4372-b5a7-836c7919548f/
SH256 hash:
658649933d0c88c7252be289027158b60cefffb9c6102bb6f963c68d9ddf8191
MD5 hash:
a9f078fc88338d20af4bbd2018a8a2d8
SHA1 hash:
524982b9d64f784080046c38ae710a636cc441d3
Link:
https://www.unpac.me/results/a66b4ed0-f335-4372-b5a7-836c7919548f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/658649933d0c88c7252be289027158b60cefffb9c6102bb6f963c68d9ddf8191

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_AHK_Downloader
Create hunting rule
Author:ditekSHen
Description:Detects AutoHotKey binaries acting as second stage droppers
Rule name:MALWARE_Win_RedLineDropperAHK
Create hunting rule
Author:ditekSHen
Description:Detects AutoIt/AutoHotKey executables dropping RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 658649933d0c88c7252be289027158b60cefffb9c6102bb6f963c68d9ddf8191

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1662341/
Cape
Cape
https://www.capesandbox.com/analysis/196328/

Comments


Avatar
zbet commented on 2021-10-09 16:06:47 UTC

url : hxxp://wowsugarbabe.top/holler/rollerkind.exe