MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7efd7f1ecb0b806efe682519dce814a1952224d789b2562d14cc51ac5a327e01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 13
| SHA256 hash: | 7efd7f1ecb0b806efe682519dce814a1952224d789b2562d14cc51ac5a327e01 |
|---|---|
| SHA3-384 hash: | 5b346b6a13fc9932bb22cee667f8001fc84ca3625691a857d2626c6d8743089667daff125673ebe659f42610d50498a2 |
| SHA1 hash: | 870ebf11dcf29c1d1b34c1696bb929e1f3204e3c |
| MD5 hash: | 19b8d00449b0cdd6335914b9cea42259 |
| humanhash: | social-comet-alpha-delta |
| File name: | 19b8d00449b0cdd6335914b9cea42259 |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 1'137'208 bytes |
| First seen: | 2022-04-08 06:53:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 69f0f2c2547db7509fa25699279b3c58 (1 x RedLineStealer) |
| ssdeep | 24576:Ekyx6DVfRdzSdnyLS/Rh01wJJip7bdrEhJdM6mBzzpinmFu4uISPWqDzo:EXURfRkdn+Qh0nbdrEhJdMzzkmFmKqDU |
| TLSH | T193353381EB18C093D7858BB24367CF95AA227FF555114213B58FB2B82D7E386A30F91D |
| File icon (PE): |  |
| dhash icon | e0f0f0dce0f0f8ec (2 x RedLineStealer) |
| Reporter |  zbetcheckin |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
19b8d00449b0cdd6335914b9cea42259
Verdict:
Malicious activity
Analysis date:
2022-04-08 08:03:53 UTC
Tags:
redline
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Searching for analyzing tools
Сreating synchronization primitives
DNS request
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Decred
Status:
Malicious
First seen:
2022-04-07 07:43:23 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
9 of 26 (34.62%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
trickbot
Result
Malware family:
redline
Score:
10/10
Tags:
family:redline infostealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks computer location settings
RedLine
RedLine Payload
Unpacked files
SH256 hash:
72baa844e610e591a7fb0777bf984fb39ff3fdc5be1889d8fdf25c8941ef284c
MD5 hash:
89fa0928008dedeec1fc4344ac02282d
SHA1 hash:
120d92bfb6ce2743bab7aff7be133aa9861e2a87
SH256 hash:
c247de9fc9b07a3bdfed8d008c4be77804e05c9549ccfffebfc10100a8d1893c
MD5 hash:
6b9df4065138030d1aa1d77ecd890e35
SHA1 hash:
9ccee832a51dfc7bd954403284547dc24dbc1314
SH256 hash:
b945494435047bf73236a0d6f3517e8e2bfc51f238f20afb32e3500aa8862f43
MD5 hash:
ca1484396f101acbac18a7fe64320e1a
SHA1 hash:
841338288b3ffcce266446d13b69ccd3b7811d12
SH256 hash:
7efd7f1ecb0b806efe682519dce814a1952224d789b2562d14cc51ac5a327e01
MD5 hash:
19b8d00449b0cdd6335914b9cea42259
SHA1 hash:
870ebf11dcf29c1d1b34c1696bb929e1f3204e3c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | malware_shellcode_hash |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect shellcode api hash value |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | quakbot_halo_generated |
|---|---|
| Author: | Halogen Generated Rule, Corsin Camichel |
| Rule name: | Redline_Stealer_Monitor |
|---|---|
| Description: | Detects RedLine Stealer Variants |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://107.189.6.214/iLdCWzek/9h3moVeFFM1T.exe