MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b
SHA3-384 hash:	14eb0f11cbff917d53f82599683e3a25cdf70db7c0abeee7f807966afd39e22e9e11641edf45bcfa71d7d5b5f7f0c26b
SHA1 hash:	a20c0d9aa53e38c7578138eeabf32f7b12448ac0
MD5 hash:	f4df53f817c548c7c8d9135a37e30789
humanhash:	mockingbird-quiet-emma-fix
File name:	f4df53f817c548c7c8d9135a37e30789.exe
Download:	download sample
Signature	RedLineStealer Alert Create hunting rule
File size:	2'219'008 bytes
First seen:	2023-04-08 14:42:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	49152:BS4OP5COu3O1nMS3kA877PA1uYl9G1VxV9S16KPyVz3KXaAPH:okOu3G3Z1u+9G1t9MpoTwaA
Threatray	261 similar samples on MalwareBazaar
TLSH	T19DA53351B3EC043BE6744B3009E602970539BD35AE7C435FAB92ACDA1E33A9070B5B5B
TrID	70.4% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 11.1% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 3.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe RedLineStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

253

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

f4df53f817c548c7c8d9135a37e30789.exe

Verdict:

Malicious activity

Analysis date:

2023-04-08 14:50:47 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2af8df53-8d24-4788-9335-3c61d2df9b05

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/380913/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.29170.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Running batch commands

Creating a process with a hidden window

Creating a process from a recently created file

Сreating synchronization primitives

DNS request

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/76999/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

Hybrid Analysis Packed.CAB

Verdict:

Suspicious

Labled as:

Packed.CAB

Link:

https://www.hybrid-analysis.com/sample/89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/c9af293f-3468-4f81-84a5-259825929368

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1210604

Signature

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rh75kyjr6imitjeatlbmdve6icjgiviqx6vfhs32ucur5ezmue5q._file

Threatray suspicious

Verdict:

suspicious

Similar samples:

155c76210badfc3ef9bfc764a7ab3cb9702f76c9d63351a213f61d44abbf0b4f

RedLineStealer

18055486aef1f706a69134be283fffdad9c49f5ffecda5d869e74c2ae882cd6c

RedLineStealer

242467ea19694c0e6cd76dcff901f5af6a309c2c999971b1dc4cd9bad253ea19

RedLineStealer

38eab87af431cba1bbec5ca10fa9502a0b110c1baf6372f5c271584b02eb2857

RedLineStealer

4b4eb8ac2362a026112033f822d2b84d5da55e18c922790d8dd2a905fdaad8cb

RedLineStealer

5920894ae997b61f27b53c9f6e598df5f928acb11a5dc09f4fa0627747f1312d

RedLineStealer

8b3915b52f03e8a23c59146ceb7f9d50b0a59e466c2c4e1f3ac3e7875106350e

RedLineStealer

ae54c18727715192eb0e5160f7ef9f7ff2382a517679a6c84e1136280ed11aee

RedLineStealer

+ 251 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/230408-r3kp6aff6s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

8b10e635d6a3d4c02ccf3bbd1df97677f8ae28c173383590b116c4144c8098ea

MD5 hash:

96bfab19b8fbaf821297fb4003a90668

SHA1 hash:

710a5eab5d76d09950d142ad353225ca86a0f961

Link:

https://www.unpac.me/results/3728dc1f-a372-40db-88d5-f60e3bddaa4f/

SH256 hash:

89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b

MD5 hash:

f4df53f817c548c7c8d9135a37e30789

SHA1 hash:

a20c0d9aa53e38c7578138eeabf32f7b12448ac0

Link:

https://www.unpac.me/results/3728dc1f-a372-40db-88d5-f60e3bddaa4f/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/380913/