MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 80983c6c00dd8ad27cb25ebc0939996802244babc9e5b61a75cc38f29697342c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RedLineStealer
Vendor detections: 18
| SHA256 hash: | 80983c6c00dd8ad27cb25ebc0939996802244babc9e5b61a75cc38f29697342c |
|---|---|
| SHA3-384 hash: | 32f3dac407d1bcac41dbeb69fc4eb2828038e178b125860674e559203b57bf2e7d8dd2643cbf5245b983d11f5a4239ae |
| SHA1 hash: | ba8400e872dbed4c389e8c618fa537254dad91af |
| MD5 hash: | 320a6c819767cd9fe47e866736760a65 |
| humanhash: | sodium-victor-fish-jig |
| File name: | 320a6c819767cd9fe47e866736760a65.exe |
| Download: | download sample |
| Signature | RedLineStealer |
| File size: | 510'464 bytes |
| First seen: | 2023-05-10 20:30:35 UTC |
| Last seen: | 2023-05-13 22:42:09 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader) |
| ssdeep | 6144:K9y+bnr+ap0yN90QEEEOD0QTj8FMfn9VC4JM2kfBGHcqfUwcMP65zPHyEJeF:PMr2y90yEi0QTYF09VBDUXkUVzjH+F |
| Threatray | 555 similar samples on MalwareBazaar |
| TLSH | T15DB41213AAD54073E4F52BB01CF603D30B3ABC929974977B6746644F2CB2AA4A431B77 |
| TrID | 70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) |
| File icon (PE): |  |
| dhash icon | f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader) |
| Reporter |  abuse_ch |
| Tags: | exe RedLineStealer |
Intelligence
File Origin
# of uploads :
3
# of downloads :
286
Origin country :
NLVendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
320a6c819767cd9fe47e866736760a65.exe
Verdict:
Malicious activity
Analysis date:
2023-05-10 20:33:01 UTC
Tags:
rat redline trojan amadey loader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a custom TCP request
Creating a file
Searching for synchronization primitives
Blocking the Windows Defender launch
Disabling the operating system update service
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
advpack.dll amadey anti-vm autorun CAB comodo greyware installer packed rundll32.exe setupapi.dll shell32.dll
Verdict:
Malicious
Labled as:
Trojan/SmokeLoader
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Verdict:
Malicious
Result
Threat name:
Amadey, RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Amadeys stealer DLL
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RedLineStealer
Status:
Malicious
First seen:
2023-05-10 19:52:41 UTC
File Type:
PE (Exe)
Extracted files:
79
AV detection:
26 of 36 (72.22%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 545 additional samples on MalwareBazaar
Result
Malware family:
sectoprat
Score:
10/10
Tags:
family:amadey family:redline family:sectoprat botnet:lider discovery evasion infostealer persistence rat spyware stealer trojan
Behaviour
Creates scheduled task(s)
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Windows security modification
Downloads MZ/PE file
Amadey
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine payload
SectopRAT
SectopRAT payload
Malware Config
C2 Extraction:
217.196.96.102:4132
212.113.119.255/joomla/index.php
212.113.119.255/joomla/index.php
Unpacked files
SH256 hash:
028b8008c8e36ee9ba17decf64b78471f2ee4bdb2b542ac3d74695e4bea5fdfa
MD5 hash:
b687075e707a850511160a448e6477d8
SHA1 hash:
b9f66936ecf4d95eda48432086d4228e472d5d1f
SH256 hash:
1c4608523433d0c98a2d18d60099c952ca925373ecfcc7204d57256022d61620
MD5 hash:
e6867196c365070442f1f0ac94f65e75
SHA1 hash:
91fad5e06ccfa29f8082bdc97b54f66f85cdc5f2
SH256 hash:
8d87b55d40abb0e13ab0cd973cd04f4ade621b240a859985242f27f68929b1b2
MD5 hash:
259fef391d7e5148b164b19a2b6526d0
SHA1 hash:
43cd8218c3fedea9d5f68b783cae2f13bfd054fe
SH256 hash:
ec19cfd6a1934b9280fef2f5bc2d980a07c62721d4ebedd3c5cc07d71d250559
MD5 hash:
6ae59c916888c9f278e7a9f4ce4e3e3d
SHA1 hash:
8fa1f11ad24d582ea1e9ea0836d9cd2d5999d869
SH256 hash:
08947ca48a65d782d168ece108afbf3da57a7c692b94dd5c15754aaaa5eb9cbd
MD5 hash:
220808d80a79d8ea9c4cda26f1542be0
SHA1 hash:
8e7fb5a04cbf18a115df5ee37f163e1b42efabea
Detections:
redline
SH256 hash:
b8c4c25d3f74fbe12cadeefa8777ec485053f0fdb90062b6e3571fea8571745e
MD5 hash:
172fc14bae16d33e5d95298f5b3fe22f
SHA1 hash:
781afc0affa5315956f23809c13fb5c9e664cd37
Detections:
Amadey
SH256 hash:
80983c6c00dd8ad27cb25ebc0939996802244babc9e5b61a75cc38f29697342c
MD5 hash:
320a6c819767cd9fe47e866736760a65
SHA1 hash:
ba8400e872dbed4c389e8c618fa537254dad91af
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.