MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f6e80385617d3629c4f408981996b6496478c7eb94ac3f17105e1eab5f5628b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f6e80385617d3629c4f408981996b6496478c7eb94ac3f17105e1eab5f5628b
SHA3-384 hash: 0ad9b3eb018ed91d7b132c5f585c06aaf37768d59e22fe886417df30c86abdff2fb3482f2bed0bcd9fe2ca2842d3b3b9
SHA1 hash: cf7713f34428c040b939e33b4c3a7e94e4e1e127
MD5 hash: ed0cba84cb6c7851527831073661a21d
humanhash: happy-august-twelve-summer
File name:ed0cba84cb6c7851527831073661a21d.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:369'152 bytes
First seen:2022-03-23 20:07:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2ac742258504eaabd5a3bfa9d9f95939 (5 x Stop, 1 x Smoke Loader, 1 x RedLineStealer)
ssdeep 6144:KDhgjYU2zVPT9eRTexqT1LkkQu+q4bk/0jBJwxXLYkz0G7YQ08YiOFEPrao/:KujYU25PT9eRYQVkhnjby0/Brb8lrR
TLSH T18274C000F750D035E5B712F48D7A83A8B93E79A15B28A4CB62C56AEE17316F4EC3135B
File icon (PE):PE icon
dhash icon 8ccc9ceeaa8ecc8e (6 x RedLineStealer, 1 x N-W0rm)
Reporter abuse_ch
Tags:exe RedLineStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/256877/
Detection(s):
Win.Dropper.Generickdz-9939781-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Sending a TCP request to an infection source
Stealing user critical data
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10992/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CPUID_Instruction
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/623b7e5b0cd58dbd92e13f42/reports/a971ae72-fbf3-4860-bbd3-d52040f3b7fd/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5a3b0e1a-2613-4476-8ff9-1b776d8b80d8
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963179
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f6e80385617d3629c4f408981996b6496478c7eb94ac3f17105e1eab5f5628b/
Threat name:
Win32.Trojan.Krypter
Create hunting rule
Status:
Malicious
First seen:
2022-03-23 20:08:16 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p5xiaocwc7jwfhcpiceydgllmslepdd6xffmh4lraxq6vnpvmkfq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/220323-ywlr7saed4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
efc71bfa408a5b9a258f077892c79d27f3c5c1e064cd4357a2d4ef849a493d34
MD5 hash:
c383a57b176315d9082198fc257e873a
SHA1 hash:
e4c5b069f65317e244e8b60c962614d83a1a1de6
Link:
https://www.unpac.me/results/d9668cfb-635a-4078-9cea-894092cea041/
SH256 hash:
d6be087cb59cf21872fad258a625db373423e555f23fdec8852540cd18ea1e76
MD5 hash:
3aa80ac9db3a4a3805d3d784f19adebb
SHA1 hash:
a6a7b8377a38340b16cb7526d5a884d5d9fc5ef1
Link:
https://www.unpac.me/results/d9668cfb-635a-4078-9cea-894092cea041/
SH256 hash:
080f3545a8f2d58d57787cb61021a002c53447d2cc68290e0749e1ce151c922e
MD5 hash:
07305fbb550b4f7d7301de0fa761a2b8
SHA1 hash:
67387e7fc97ce08c3b5add1eceb78f9754bca481
Link:
https://www.unpac.me/results/d9668cfb-635a-4078-9cea-894092cea041/
SH256 hash:
7f6e80385617d3629c4f408981996b6496478c7eb94ac3f17105e1eab5f5628b
MD5 hash:
ed0cba84cb6c7851527831073661a21d
SHA1 hash:
cf7713f34428c040b939e33b4c3a7e94e4e1e127
Link:
https://www.unpac.me/results/d9668cfb-635a-4078-9cea-894092cea041/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7f6e80385617/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f6e80385617d3629c4f408981996b6496478c7eb94ac3f17105e1eab5f5628b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

Executable exe 7f6e80385617d3629c4f408981996b6496478c7eb94ac3f17105e1eab5f5628b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2109431/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/256877/

Comments