MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210
SHA3-384 hash:	43fce6da24e447401a800cdec3e6eb19437efc1497c0a78fd201ba91c522b48bd653bf0a68ec71718d3d7ed082a8735c
SHA1 hash:	a05f1dd5f30a7e05bb4f5a69213492bd62fc965d
MD5 hash:	dfba8244fe43e7ab20b67557c3e61976
humanhash:	gee-six-triple-five
File name:	dfba8244fe43e7ab20b67557c3e61976.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	337'408 bytes
First seen:	2023-07-02 22:51:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4aa773f91d20506f2979a40c36a81664 (8 x RedLineStealer, 2 x Amadey, 2 x Tofsee)
ssdeep	6144:a6LLQr1DkpVnXYE3tR4BsZP01ewDXxBLCx+kPr5vR8O:nQr1o4MtR4KZMvrjCx5f8O
Threatray	1 similar samples on MalwareBazaar
TLSH	T17174D01356A17C55D8268E728F2EC6E4B71FF5B08F49776AA21C6B9F0CB01B2C267341
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0002034144212c10 (1 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe RedLineStealer

abuse_ch

RedLineStealer C2:
194.26.135.162:2920

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

255

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox RedLine

Detection:

RedLine

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/405504/

ClamAV Detected

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/64a1ff943d1253262b2d2dae/reports/28381556-277e-4267-8ea3-6957927cf55d/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious Packer

Malware family:

Malicious Packer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/69855a2b-0aad-4d82-a328-e08bb606d588

Joe Sandbox RedLine

Result

Threat name:

RedLine

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1265279

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210/

ReversingLabs TitaniumCloud Win32.Trojan.SmokeLoader

Threat name:

Win32.Trojan.SmokeLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-02 22:52:06 UTC

File Type:

PE (Exe)

Extracted files:

28

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=red55quzs523walyk7tplftydnjhemzcdy2bxypyz5gmy3opiiia._file

Threatray malicious

Verdict:

malicious

Similar samples:

fb77c72161a3885499d305cc95dd95a28426a5cf549fdfcbfa2b95c632171e41

RedLineStealer

Hatching Triage redline

Result

Malware family:

redline

Alert

Create hunting rule

Score:

  10/10

Tags:

family:redline discovery infostealer spyware stealer

Link:

https://tria.ge/reports/230702-2tdklafa7w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

RedLine

RedLine payload

UnpacMe 10

Unpacked files

SH256 hash:

8acee876375e9e139f2c4b805142acc00566e7d35b47d192395a8bd34e94636e

MD5 hash:

c0766de0a38b7d3489800a1e2214f9c2

SHA1 hash:

312b9a946022f0654b5d65c3ca80e688ec8f14ec

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

e1bd091f64886cc5e6b5f82be833c5566d3f00f7b0fbc937f18cf2e6d72c0ae8

MD5 hash:

a78ceaf985db26d6f52bd44270582ac5

SHA1 hash:

17bfc99cf78fcccafb5ed95a24b5a63527b96f9c

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

95bcf6d38f4836fa5ffa8ef3780d5a6589b00cb99fc834eea774334ddf6864b5

MD5 hash:

7aced252e230592bfe5835e2ea2429bd

SHA1 hash:

0e7b3d44f6ed9c3cbc5530e4a5e626a4824522d9

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

8acee876375e9e139f2c4b805142acc00566e7d35b47d192395a8bd34e94636e

MD5 hash:

c0766de0a38b7d3489800a1e2214f9c2

SHA1 hash:

312b9a946022f0654b5d65c3ca80e688ec8f14ec

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

e1bd091f64886cc5e6b5f82be833c5566d3f00f7b0fbc937f18cf2e6d72c0ae8

MD5 hash:

a78ceaf985db26d6f52bd44270582ac5

SHA1 hash:

17bfc99cf78fcccafb5ed95a24b5a63527b96f9c

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

95bcf6d38f4836fa5ffa8ef3780d5a6589b00cb99fc834eea774334ddf6864b5

MD5 hash:

7aced252e230592bfe5835e2ea2429bd

SHA1 hash:

0e7b3d44f6ed9c3cbc5530e4a5e626a4824522d9

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

8acee876375e9e139f2c4b805142acc00566e7d35b47d192395a8bd34e94636e

MD5 hash:

c0766de0a38b7d3489800a1e2214f9c2

SHA1 hash:

312b9a946022f0654b5d65c3ca80e688ec8f14ec

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

e1bd091f64886cc5e6b5f82be833c5566d3f00f7b0fbc937f18cf2e6d72c0ae8

MD5 hash:

a78ceaf985db26d6f52bd44270582ac5

SHA1 hash:

17bfc99cf78fcccafb5ed95a24b5a63527b96f9c

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

95bcf6d38f4836fa5ffa8ef3780d5a6589b00cb99fc834eea774334ddf6864b5

MD5 hash:

7aced252e230592bfe5835e2ea2429bd

SHA1 hash:

0e7b3d44f6ed9c3cbc5530e4a5e626a4824522d9

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

SH256 hash:

8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210

MD5 hash:

dfba8244fe43e7ab20b67557c3e61976

SHA1 hash:

a05f1dd5f30a7e05bb4f5a69213492bd62fc965d

Link:

https://www.unpac.me/results/04973a4b-a0a9-42a7-9dcc-085510fa94a8/

VMRay RedNet

Malware family:

RedNet

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8907dec29997/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RedLineStealer

exe 8907dec2999775bb017857e6f596781b527233221e341be1f8cf4ccc6dcf4210

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2670388/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/405504/