MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75ffe79a4c3206cdf7fc405597fa5ac7c82751dc729276d1e9564d1caffca85a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	75ffe79a4c3206cdf7fc405597fa5ac7c82751dc729276d1e9564d1caffca85a
SHA3-384 hash:	bda6ab74a403a36feef2a7b7756fec7d1c8a7ff1c78262bf6652919a38a91bf8704ad2f75b0d93c17ee52d47faaedfad
SHA1 hash:	9c4f1ef8ba4fe34b440a79cc6195cfd85ad21026
MD5 hash:	446078ee949fb62fe15d3a901ce255d7
humanhash:	fanta-video-charlie-freddie
File name:	446078ee949fb62fe15d3a901ce255d7.exe
Download:	download sample
File size:	786'432 bytes
First seen:	2023-07-03 08:27:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a4a6d285c99bdb73e593491b15a4c14c (258 x RedLineStealer, 183 x Amadey)
ssdeep	12288:9l49CQ2PBsY0fFZTpH54b37J4Bsk7UZcviokvSJBB8DS7tCBeBzp9wY8yqzSYL:9l49ypanTpH5aPaaoNB8DS7tCBeBzp2R
TLSH	T103F4122D286050F2D9ABD8FEF8F3E9C337FC2C2A22249773A59517F919235A25467113
TrID	38.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.5% (.EXE) OS/2 Executable (generic) (2029/13) 15.4% (.EXE) Clipper DOS Executable (2018/12) 15.2% (.EXE) Generic Win/DOS Executable (2002/3) 15.2% (.EXE) DOS Executable Generic (2000/1)
Reporter	abuse_ch
Tags:	exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

245

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/405780/

ClamAV Detected

Detection(s):

Win.Packed.Zpack-10005470-0

Alert

Create hunting rule

Win.Malware.A8he2bmi-10005536-0

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95211/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/64a286922299d26882644fef/reports/f6d2dd68-2f1f-4526-92ae-b40475655ed5/overview

Hybrid Analysis Win/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/75ffe79a4c3206cdf7fc405597fa5ac7c82751dc729276d1e9564d1caffca85a

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/bbe2d86e-14a6-4f44-a3f6-245b05d3cf17

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1265652

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/75ffe79a4c3206cdf7fc405597fa5ac7c82751dc729276d1e9564d1caffca85a/

ReversingLabs TitaniumCloud Win32.Trojan.RedLine

Threat name:

Win32.Trojan.RedLine

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-02 14:56:45 UTC

File Type:

PE (Exe)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ox76pgsmgidm3574ibkzp6s2y7ecouo4okjhnupjkzgrzl74vbna._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230703-kczytsff57/

UnpacMe

Unpacked files

SH256 hash:

75ffe79a4c3206cdf7fc405597fa5ac7c82751dc729276d1e9564d1caffca85a

MD5 hash:

446078ee949fb62fe15d3a901ce255d7

SHA1 hash:

9c4f1ef8ba4fe34b440a79cc6195cfd85ad21026

Link:

https://www.unpac.me/results/8d877921-dc84-4578-b0c7-70bdd5f75816/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 75ffe79a4c3206cdf7fc405597fa5ac7c82751dc729276d1e9564d1caffca85a

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2674943/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/405780/