MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93
SHA3-384 hash: 8c45ebcaeb1821ad256068ff0e1cfaa496a1623f962525c2f3d3a894df323e72822b365b846abe27b1750fc9de785998
SHA1 hash: d043db0f576cb97efe3edd11890795319becd70b
MD5 hash: 6b8db5cd41df873b90f18fdb09b1a4bf
humanhash: eleven-venus-robert-summer
File name:6b8db5cd41df873b90f18fdb09b1a4bf.exe
Download: download sample
File size:195'072 bytes
First seen:2023-07-28 07:00:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 66 x LummaStealer, 61 x Rhadamanthys)
ssdeep 3072:TahKyd2n31/5GWp1icKAArDZz4N9GhbkrNEk1+q9nqtrJReNyT:TahOfp0yN90QEIQzh
Threatray 2'380 similar samples on MalwareBazaar
TLSH T15414AF4A63E460A6E4BA57B498F302835A31BCB15B7582FF12C4D57E0E336D4AA31F17
TrID 83.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
6.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
4.4% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/435850/
Detection(s):
SecuriteInfo.com.Trojan.DownLoaderNET.688.4659.9090.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.DownLoaderNET.688.32409.9930.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack CAB control explorer installer lolbin packed rundll32 setupapi shell32
Link:
https://www.filescan.io/uploads/64c367b25154a489a459309e/reports/3da717a1-0fe3-4ba6-b266-06fb9a9b8e06/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/805dfed9-e25e-4bc9-b98f-ff31640c553a
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1281659
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-07-27 14:18:49 UTC
File Type:
PE+ (Exe)
Extracted files:
45
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pg6ncrlie2wi4nvgudfppbqamcpszw35jomr4yzrhpcwkhn4j2jq._file
Verdict:
malicious
Similar samples:
114210ddeecbf5dd4320338e5a3c5a156841ae1390732a2b71e324f161e32932
19048224db55038a6aac7521d4ca49513e68f67f3042fdd874e2f3d415823141
211809c137b352584707b7d3b254df7e9b80302615f758ff8060b535d8804945
61e5238c2b4d2e972872d5ae5a95758bb9a7a2e236403aca6805cd939f57a295
737a4e3c0bc536fddc9f55099a01736da0b5ecb543d62b55ec3f29650a1305d8
b6a1f7a46ead00ddc8691bc83782d299934ef81a8dd9517d09aadd4296120ef3
cffee94b2fed3ea5bf85eb7bab308ac9488d1ed882c02787ee318760b1a90350
e0270356bde8bc3b16ba817d006958604d690f72b621db019be44faa6cdf4bde
fb9295be3b011faf14a3e3d382a24eb47cf8877f3fcbf2bbc598c92cf3a48181
+ 2'370 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/230728-hs782acg2s/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93
MD5 hash:
6b8db5cd41df873b90f18fdb09b1a4bf
SHA1 hash:
d043db0f576cb97efe3edd11890795319becd70b
Link:
https://www.unpac.me/results/a9876a6a-9139-4531-94d8-4da693d537fa/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/79bcd1456826/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Redline_Stealer
Create hunting rule
Author:Varp0s

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 79bcd1456826ac8e36a6a0caf78600609f2cdb7d4b991e63313bc5651dbc4e93

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2690328/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2684641/
Cape
Cape
https://www.capesandbox.com/analysis/435850/

Comments