MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8499aa17997bfbe03592e33e82df1c674f1b57ba3d372355e690b9468ea6fea2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RedLineStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	8499aa17997bfbe03592e33e82df1c674f1b57ba3d372355e690b9468ea6fea2
SHA3-384 hash:	b528b6ace63c1e53b831153abf39345aa665c906ace620469945f7840893eeeb8aca12f34afb66f0563bd142bf5e18c5
SHA1 hash:	265ff15cef88d7125b431aba9d87e96d965b23b8
MD5 hash:	f1fec6776a311dea73a14e9f344a296b
humanhash:	happy-helium-sierra-yellow
File name:	f1fec6776a311dea73a14e9f344a296b.exe
Download:	download sample
Signature	RedLineStealer Create hunting rule
File size:	648'192 bytes
First seen:	2020-06-17 18:40:28 UTC
Last seen:	2020-06-17 19:50:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	582c44c1c2229788dad082906f3c035c (1 x RedLineStealer)
ssdeep	12288:zu/YWOp9gKrxF5Dhi2DCFN/cYXE95cYfRaVvg8tkLPE9:zuwWOp9gmFTi2ykEC5HRaV4a
Threatray	57 similar samples on MalwareBazaar
TLSH	96D4020EBED4D0B5C9D207315C65E8A01A3DBCB5C936E67B3794BA0D18312D09BB26BD
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/19575/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.CryptInject

Status:

Malicious

First seen:

2020-06-17 19:35:36 UTC

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qsm2uf4zpp56anms4m7ifxy4m5hrwv52hu3sgvpgsc4undvg72ra._file

Verdict:

malicious

RedLineStealer

34e142c3ca75844c48639cfc8f60513d23c02a65addef3bce69f5b49b34277a1

RedLineStealer

5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7

RedLineStealer

5ef8714caf9c7296847b67b27edb93c3aec23d7e77b57d23d0e8607d707a2c49

RedLineStealer

6c90f16a6932be921cbb44b9e4531cf36e5ded6d5dd0016c4309a56ab8a96461

RedLineStealer

85d879be258470ed22d55bb6fda8be5d0b7d480c23d95b252516e85ccad2fec4

RedLineStealer

991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec

RedLineStealer

e3bb8c334350185803b3863f71d6fced186b373e8768bb537e371dff11f74386

RedLineStealer

ec837014dcb222fd3780d0730e297c9a09786cc57a42a9da092c9199c1f9660b

RedLineStealer

f4901daf97516f9a9b54233dd81810398de07db40d47072f37d90b4225387fd2

RedLineStealer

+ 47 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

evasion spyware trojan

Link:

https://tria.ge/reports/200624-qkz6w7epls/

Behaviour

Checks processor information in registry

Modifies system certificate store

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Unknown_PWDumper_Apr18_3 Create hunting rule
Author:	Florian Roth
Description:	Detects sample from unknown sample set - IL origin
Reference:	Internal Research