MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79fe7b201279d48039678693e3aa451ab846cc87a258746d5374963f4a76f065. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	79fe7b201279d48039678693e3aa451ab846cc87a258746d5374963f4a76f065
SHA3-384 hash:	cd564c901315fd8d20610919e1b0bdb17a3daec28de6dc360fc6005da9815a83f263b71789d309043b36c15c35412e99
SHA1 hash:	c170e0224b7a332c64af6623841cc0bcc070f117
MD5 hash:	1e16952eb243abd6039aa6dd908d1df7
humanhash:	twenty-high-green-coffee
File name:	1e16952eb243abd6039aa6dd908d1df7.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	694'272 bytes
First seen:	2022-02-01 16:55:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7b6d6cf404065cc0908a78aad9aa1788 (4 x Smoke Loader, 2 x ArkeiStealer, 1 x RaccoonStealer)
ssdeep	12288:38i27r/kxBaU81/CFxzPMbFLAPgR7B3tsvRpqyesCEIIcA+FaTmy6xhUl4iE7:3crCYx/mxzP4FL9ttsMsvRuFaTHWh44V
Threatray	887 similar samples on MalwareBazaar
TLSH	T1ACE4F110BB90D035F1B726F84A79D369A52E7EA19B2061CB63D01EEF5A356E0EC31317
File icon (PE):
dhash icon	25ac1378399b9b91 (28 x Smoke Loader, 24 x Amadey, 21 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/229262/

Detection(s):

Win.Dropper.Tofsee-9916986-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Сreating synchronization primitives

Query of malicious DNS domain

Sending an HTTP GET request to an infection source

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/5707/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CPUID_Instruction

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61f9662ca0f6a794b330ec5a/reports/3701cd40-0f04-48f4-a846-f73969de45e8/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

RedLineStealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7aeb1761-4142-4f4d-862e-55b2499a6e05

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/931867

Signature

Antivirus detection for URL or domain

Contains functionality to register a low level keyboard hook

Creates HTML files with .exe extension (expired dropper behavior)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample or dropped binary is a compiled AutoHotkey binary

Yara detected Autohotkey Downloader Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/79fe7b201279d48039678693e3aa451ab846cc87a258746d5374963f4a76f065/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-02-01 16:56:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ph7hwiasphkiaolhq2j6hksfdk4entehujmhi3ktosld6stw6bsq._file

Verdict:

malicious

RedLineStealer

107f635399e85814f231c1db5a232c2b31d97c09fcf0a542e8d65f7cfe98cfb5

RedLineStealer

1c9280c4101e0bcdd266eeda804e61f07bfd5a2a08117077abf7ef63ae8347b6

RedLineStealer

49e784cd4664d480317bc3e726821d153e14ebc8b335cebce963ec427e4dcea9

RedLineStealer

51dab2aed9a33526c883c60b970d756e7fe8215630861d61c839d4a491a91120

RedLineStealer

571174b8ae101207a90c2a1033716cedf4dcc5fddcd8e6e506133f4a1b79bb91

RedLineStealer

d59ae43affeee4773c89a3bddf6da80f88e86dc5c91184890864f97fc7cd5f5b

RedLineStealer

d7bb16b7dfccf4813d4b6611c8600bce6a55cd495eb67500a59fa73ff085ff55

RedLineStealer

f77ee607590d0eea0340f732222a78f3ffdb990c45796075071b051aeb83afbe

RedLineStealer

+ 877 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220201-vfpblshfgj/

Unpacked files

SH256 hash:

86cec2665ff431668f274fecddf883fb5b532c06ee1a495ce60d5fbbb90c3a33

MD5 hash:

f7246b8631cad60d643fe3625a823397

SHA1 hash:

3aabf69029480970b338bb37a511d307aaf40c79

Link:

https://www.unpac.me/results/1f054bc0-de91-4b1f-ba80-9adb8c093c3a/

SH256 hash:

79fe7b201279d48039678693e3aa451ab846cc87a258746d5374963f4a76f065

MD5 hash:

1e16952eb243abd6039aa6dd908d1df7

SHA1 hash:

c170e0224b7a332c64af6623841cc0bcc070f117

Link:

https://www.unpac.me/results/1f054bc0-de91-4b1f-ba80-9adb8c093c3a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/79fe7b201279d48039678693e3aa451ab846cc87a258746d5374963f4a76f065

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_AHK_Downloader Create hunting rule
Author:	ditekSHen
Description:	Detects AutoHotKey binaries acting as second stage droppers