MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66afba1b0f002f8dc370a3702f5550f3917036821ec5c22c084d8572f00b9418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66afba1b0f002f8dc370a3702f5550f3917036821ec5c22c084d8572f00b9418
SHA3-384 hash: bfd7dcc407b5afaaada713de95ecbc93fd71c1b95429e64de7a336548dd855a9e0578f7183c6e1dab33a95134f85ed81
SHA1 hash: f74becc154bfcf4e6eff46bf7e7efcc6517997d0
MD5 hash: 303c3dcc64c962edbff8d203519c02df
humanhash: sierra-river-hydrogen-sierra
File name:303c3dcc64c962edbff8d203519c02df.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:973'312 bytes
First seen:2020-06-28 07:38:23 UTC
Last seen:2020-06-28 08:44:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 64d01cffaa8cf78ae10809a1df386b08 (1 x RedLineStealer)
ssdeep 24576:MBL33UJwuC9Al92OaXRzLg6upYq4+doXrpj4ViNJOwj:MRnMfC9AL2OaXR2pZb+bpj4Vin
Threatray 278 similar samples on MalwareBazaar
TLSH 1C2522363145D032E0933975E867C7E05E7EB52043B541BF63A42AEEBF731905A363AA
Reporter abuse_ch
Tags:exe RedLineStealer


Avatar
abuse_ch
RedLineStealer C2:
http://195.161.114.33/IRemotePanel

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15165/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Running batch commands
Using the Windows Management Instrumentation requests
Searching for the window
Forced system process termination
Connection attempt to an infection source
Launching a tool to kill processes
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66afba1b0f002f8dc370a3702f5550f3917036821ec5c22c084d8572f00b9418/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 00:30:56 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m2x3ugypaaxy3q3qunyc6vkq6oixanucd3c4elaijwcxf4alsqma._file
Verdict:
malicious
Similar samples:
262e75b938cc8b65820cf4015f33ab3db363eb7a968c23bdd48e7a680d97a9f7
RedLineStealer
3a433d9d40efde586b6da1409014e23c3c08a668f3148682524406f852e239af
RedLineStealer
5c164b47abfcecfc8f75d220cffbe8a9de97cf956154783aae6d885c180c1e8d
RedLineStealer
62824d9a353a539053724252d3710008e5894f3580fec8449ec38b7828e7b389
RedLineStealer
a7116dc8a8296b97287b628c8cc8cc5fd834557d6d0fc29d5944fd1e4a30b8a3
RedLineStealer
a75040c1f0f11bf9629774525960c9cf35153727e1191057b575fb3c1ed0700a
RedLineStealer
aa30299c8266809acb727ef5ec89a80f0cdbcc848550607743f256438f00e398
RedLineStealer
aa4ea575f062475547ce69415145acded3eda98cff4e8e2b532b1f3201b1b0bf
RedLineStealer
d51861bee7da084197de80b44da801303efb75d19d27bad917eac7dd6036cb71
RedLineStealer
e8406edde4743eec38d88fd58f2c79b11d09d76bcd57b757cdf5844ea5bd55e7
RedLineStealer
+ 268 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
evasion spyware trojan discovery infostealer family:redline
Link:
https://tria.ge/reports/200628-wjsabk9fna/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Kills process with taskkill
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks for installed software on the system
Modifies system certificate store
Looks up external IP address via web service
Reads user/profile data of web browsers
RedLine
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15165/

Comments